Well, by definition almost a Distributed DoS attack implies some kind of mob. Now, it could conceivably be some rich individual illegally paying money to an illegal botnet, but it could also very well be a larger group of people conspiring to illegally pool their money to buy time on an illegal botnet. It could also theoretically be a large group of people illegally conspiring to attack the site directly using their own machines.