From what I understand the DDoS is necessary to force the Tor daemon to choose a new guard which is what they need for their attack.

As far as deanonymizing it goes, one theory could be that it’s an automated process that crawls the open web for onion links and tries to deanonymize them all.