All these comments saying it's just a salient target are making it up. Canonical is a military contractor. They literally have an entire DoD team. That's why they're being targeted. They're far from the only military contractor to be targeted by Iranian hackers this year

Is this written down anywhere? All I can find is an announcement from the group and a follow-up message threatening Canonical if they do not negotiate.

What does a DDoS accomplish if the contracts are signed and a team embedded?

Why take down security.ubuntu.com? Surely even cyber jihadis need security updates?