I haven't a clue what they gain except 'gloat points' and denying useful
sites to those wanting or needing to get to them. I helped moderate a very
large site for about 7 yrs and they suffered through a couple of them. Takes
a massive effort on the part of the site's sys admin to even begin to cope
with it.
It also points out the need for good, strong, current and actually used
security software on personal systems: a DDOS attack can't really be
effective without g'zillions of zombie systems to take part in it. And you
don't build an army of bots from effectively protected systems.