The most surprising part: no bot net. Attackers used memcached on various compromised servers to create the biggest amplification attack anyone has ever witnessed. Amazingly, the entire incident only resulted in a 20 minute outage (thanks to efforts from the team at Akamai Prolexic).