Soo...

I did a 20-year stint in IT security (quit when my company was bought by a capital fond that wanted us to still do all the things but preferred not to pay wages.)

I still don't feel qualified to guess what happened here - since I know next to nothing about this incident.

But darn it, it's not like we have anything else to do...

So here's my wild (emphasis) guess.

a) Lots of organisations have an "allow any" hole in their firewall for ike+ipsec, usually for reasons like "that protocol seems complicated, firewalling it would be complicated", more or less.

b) There used to be botnets that could pacify routers with modified GRE datagrams, specifically the "Mirai" botnet, operating from hijacked webcams (doesn't exist anymore afaik).

c) New botnets have surely emerged, and improved on the capabilities, maybe building on the publicized source code.

d) Just to give a random example, the "Proxynvader" botnet hijacks TV sticks; assessments vary but some experts say a quarter million, some say up to 8 million devices, each capable of delivering 0.1 Gbps into a volumetric attack.

I think it wouldn't be far-fetched to imagine one of those botnets grew the capability to spoof fx. ipsec datagrams, and that someone out there decided it would be fun if Microsoft's server parks started spending more time on fragment reassembly and decryption and less time doing whatever Microsoft thinks those servers should be doing. And then began blasting them with traffic on fx. 4500/udp.

(So in this example, traffic is routed around the normal ingress path through load balancers, tls offload, etc. for those servers, hitting them directly on a public IP via a permissive firewall rule instead.)

I think my odds of being correct are about 1% :-), since little is publicly known yet (and I personally know much much less than that.)

I enjoy reading the other theories here; some very interesting ones!

Haven't given much thought to motivation, could be anything. (I guess having an impact on the equity price means there's theoretically a profit to be made though.)

(... tldr: "ddos maybe?" ...)