> Why not try to attack their internal infrastructure instead?

Because that will attract international law enforcement, and ruin your life if caught. DDOS is pretty safe cybervandalism that everyone can join with a couple of clicks. It's also pretty low impact besides a few stressed IT workers, but that's mostly what anonymous does.

The days of LulzSec made us think that was the tip of the iceberg of Anonymous, but it was peak Anonymous and we didn't know it.