A Distributed Denial of Service (DDoS) attack is a digital ambush: thousands of compromised systems flooding a service with so many requests that legitimate users are shut out. It is chaos delivered at scale: a forced blackout by sheer overload. There are various known layers for this attack. Layer 7 is the harshest of them all. It strikes higher. It mimics real users, targeting the application itself – the place where logic lives and meaning is made. It exhausts a system not with noise, but with perfectly crafted pretenses. It can also be described as quiet siege, delivered one “normal” request at a time.
Part I: The Flood
The Uneasy Rhythm
The Assembly of Dawn – a large, well-funded organization that presents itself as a charitable and spiritual movement. Runs shelters, clinics, youth programs, and a constant online stream of talks and events. On the surface, looks like a modern faith-based nonprofit focused on “community,” “hope,” and “transformation.”
Behind that public image – a highly organized recruitment and influence machine. Targets mainly young people through “study groups,” retreats, and online content, gradually pushing
them toward obedience, emotional dependence, and full commitment to the group. Doubt is discouraged, critical questions are framed as personal weaknesses, and leaving made difficult
both socially and psychologically. It feeds people, yes, but it also feeds on them.
The Assembly of Dawn liked to call itself a movement.
Part charity, part spiritual revival, part empire in training, it curated an endless livestream of
hope, smoothed to a mirror finish. On paper, it existed to uplift. In practice, it existed to grow and make revenue for certain people. Its headquarters rose out of the city like a gleaming confession: glass, steel, a lobby scented with polished marble and expensive incense. Every inch of it was designed to feel cleaner than the world outside.
On the operations floor above the marble, a wall of monitors formed a different kind of
cathedral. Instead of stained glass and pews, there were latency charts, traffic graphs, error
budgets, and user sessions glittering like constellations, a digital congregation counted in metrics instead of souls. Recruitment was an algorithm wrapped in scripture. Obedience, the first and greatest virtue. Doubt, a flaw to be corrected. Young minds were the most “open to transformation,” as internal memos liked to say.
At 10:18 everything looked normal. Status tiles glowed a reassuring green. Fans hummed in steady harmony. The network’s heartbeats ticked along with the casual arrogance of a system that had forgotten how it was to fail.
Amara Reyes hadn’t forgotten. She stood at the center of the bridge, a mug of coffee going cold on the console, and watched the graphs the way a paramedic watches a chest, not just up and down, but tempo and pattern. Amara had seen floods before, cheap volumetric attacks hammering on Layer 3 and 4, “trucks across the highway” stuff. This didn’t look like that. The latency line twitched. Just a little. “Malik,” she said, without raising her voice. “Are you seeing that?” Malik Ghattas, the site reliability lead, slid his chair sideways on worn casters. His desk looked like an occupied cockpit: terminals, sticky notes, a faded mug that said: DO NOT MAKE PROMISES SOFTWARE CAN’T KEEP, in letters that had gone through the dishwasher too many times. He narrowed his eyes at the response-time panel.
“Requests are clean. A little too clean.” he said.
“Application layer,” he continued, horrified. “Layer Seven.” The word carried its own weather.
“How many?” Amara asked.
“Climbing,” Malik replied. “And they’re shaped like people.”
Pressure on the Glass
The Assembly of Dawn ran an aggressive recruitment machine with a doctrine that said
obedience was the purest form of love. Recruiters went where teenagers lived: campuses, group chats, streaming platforms. Study groups became vows. Doubt was treated like a virus. On the internet’s back alleys, former members compared notes about scripted conversations that had backed them into corners.
Downstairs, those stories lived in whispers and forums. Up here, on the ops floor, they lived as traffic. Nia Strand, the communications director, leaned against the back of a chair and watched Amara and Malik trace graphs. Her job was words, but she understood numbers well enough to know when they were starting to snarl.
“Talk to me,” she said.
“Application-layer surge,” Amara answered. “They’re talking to our services like they’re old
friends. Browsers and phones, all very polite. No blunt-force volumetric nonsense.”
“So this isn’t just ‘too much traƯic, everything down’?” Nia asked.
“This is ‘app suffocating under realistic conversations’,” Malik said. “If you were going to break
us for maximum impact with minimum visibility, this is how you’d start. You don’t knock over the building. You clog the doors.”
Nia opened her notebook. “At what point do we tell the outside world?”
Amara took a breath, watched another spike form. “When truth helps instead of panics,” she
said. “We’re not there yet. But we will be.”
First Wave
At 10:42 a.m., the flood finally showed its shape.
Thousands of browsers began hammering the same page, the one that hosted the day’s sermon, as if half the city had decided to refresh it in unison. Each connection looked authentic – normal time zones, real device types, language settings that matched the Assembly’s audience profile. It was polite, believable, and utterly devastating.
Almost at once, the donation portal came under siege. The bots filled out every field with
practiced precision: names, email addresses, even card numbers that passed the first layer of
validation. Payments appeared to go through, then froze just before the receipt could print. Transactions hung in limbo – burning resources, eroding confidence. Malik watched the metrics spike. “This director knows our traffic,” he said, voice flat. “They’ve profiled our cache, our content delivery network, our gateway handshakes. They know which pages we’ve tuned, which we haven’t.”
He tapped a few keys. Limits on the traffic began to change.
“Ease on the brakes,” he said. “Slow things down per connection and per network, make it
harder for the fakes to push through, but try not to slam real people into a wall while we do it.”
“Brownout step one,” Amara called. “Drop image sizes. Prefer audio over video on all streams.
Protect ‘shelter’ and ‘clinic’ above everything else. Nobody loses access to a bed or a doctor
because of this.”
Engineers spread across the floor acknowledged with short, clipped answers. Dashboards
reshaped themselves as rules rolled out. The stream resolution sagged. Some viewers complained in the comments, others assumed it was their own connection.
For the attackers, it was just another piece of the puzzle to solve.
(In operations jargon, a brownout is a controlled partial shutdown, not a full blackout but a
deliberate dimming. It lets non-essential features degrade gracefully, so that the system can stay alive for critical services. Instead of everything collapsing, only the decorative or heavy pieces slow down, buying time and preserving the parts that matter most.)
People Behind the Packets
The livestream chat flickered from cheering emojis to confusion:
why audio only?
anyone else getting errors?
my receipt didn’t go through??
In the help center, rows of support representatives sat under harsh ceiling lights, headsets on,
monitors showing more tickets than the day before. At Desk 12, a volunteer named Frida held
her headset a little tighter.
“Shelter hotline, this is Frida,” she said. “How can I help?”
On the other end, a woman’s voice wobbled. “I’m outside the Third Street shelter. The app keeps crashing when I hit ‘request.’ I’ve got my kids with me. They’re tired.”
Frida glanced at her dashboard. The shelter portal was labeled DEGRADED in orange.
“Stay where you are,” Frida said. “Can you tell me your name?”
She typed as the woman spoke, eyes flicking to the bridge channel, open on a side screen.
On the ops floor above, Malik read Frida’s urgent message. “We have a mother with two kids at
Third Street, portal failing,” he reported.
“Open a window,” Amara said.
Malik created a narrow rule: whitelist that phone number, that IP range, that endpoint. He
watched the firewall logs, as a surge of synthetic traffic tried to squeeze through the same crack.
He let the real request through and slammed it shut behind her.
“That’s one family,” he said. “Three living humans. Mark it.”
Nia’s second statement went out on the website and across their social channels in plain
language:
We are experiencing extremely high traffic that is affecting some services.
Shelter and clinic access are our priority.
We will provide another update in twenty minutes.
No drama. No spin. Just the truth, standing there without makeup.
Choking the Air
The director switched strategies.
Traffic peeled away from the donation page and crashed instead into account recovery, sign-ups, and private messages. Password reset requests poured in for accounts that had never existed.
New registrations arrived with believable names and addresses tied to throwaway emails. Direct
messages flooded clergy and staff inboxes that would never open, because the mail queue was
already choking on the volume.
“Their goal just moved,” Amara said. “It’s not the money, at least not right now.”
“They’re going for our communications layer,” Malik agreed. “If they can starve our email and notification systems, we can’t talk to the people we serve or to our own staff. We can’t warn.
We can’t rotate credentials. We can’t send receipts, which will look like fraud.”
He tagged the transactional email service and phone gateways as critical. Rate limits tightened
around everything else.
“Lock down bulk,” Amara said. “Reroute anything shelter- or clinic-related over SMS, if we
have to. Keep the phones clean, even if the inboxes drown.”
Nia’s team rewrote the internal plan: if email went down, managers would switch to secure
messaging, if that failed too, the phone tree would light up like an old-fashioned alarm chain.
“Write as if people will screenshot everything,” Nia instructed. “Because they will.”
Breaking Point
A voice from the edge of the room called out, “The media servers are starting to fail.”
Moments later, the payment system hiccupped and then went down hard, like an animal in a
slaughterhouse taking a fatal blow.
On the main board, red lights began to spread.
Servers that handled videos started blinking in and out. The systems that connected different
parts of the site strained at their limits. Background tasks clawed for memory and power that just
weren’t there.
“Brownout, second stage,” Malik said. “Cut anything that isn’t essential. If something has to fail,
let it fail simply and clearly. No ugly crash screens, no cryptic errors—just honest messages and
another way through if we can give it.”
He pointed to four screens, each running a different trace of the attack.
“This is not a pipe flood,” he said, loud enough for the room. “It’s choreography. They’re
changing tempo every time we adjust. Their bots wait for our reaction, then adapt. This is
someone who studied us.”
Amara moved to stand beside him, arms folded. “Then they think they know where we’ll break,”
she said. “Let’s prove them wrong.”
Harm at the Seams
The next adjustment from the director was subtle and cruel.
Real traffic: volunteers checking shifts, donors refreshing a stuck receipt, regional coordinators
pulling attendance, was braided together with synthetic requests so closely that even the
automated filters struggled to see daylight between them.
The Web Application Firewall (WAF) – the software designed to block dangerous requests before they reached the application, hesitated. To its algorithms, every browser looked guilty, and every bot looked sincere.
Legitimate visitors found themselves locked out beside intruders. Genuine logins and forged
ones collided and blended until the system could no longer tell intent from imitation.
“Collateral damage is not an inevitability,” Malik said quietly. “It’s a decision.”
He began carving narrow tunnels through the defenses for known contacts: trusted phone
numbers, IP ranges used by shelters, networks owned by partner clinics. Each time he opened one, a black tide of malicious traffic tried to follow.
He slammed the door, opened another, slammed that too.
“Keep feeding me names,” he told the help desk on the bridge channel. “Every real person you
bring me is someone I can treat as more than a metric.”
Nia’s third update went out:
We are prioritizing shelter, clinic, and critical support access.
Other services, including streaming and donations, may be limited.
We will share more details when we can do so accurately and safely.
The phrase “accurately and safely” was deliberate. It told readers there was more to say than they could, yet, say without guessing.
The Council and the Stream
The founders’ council joined the incident bridge from scattered locations: a sunlit office, a dim
study, a parked car. Their faces lived in separate rectangles, united by anxiety.
“How long will the stream be down?” one of them asked. “Afternoon programming is integral to
our outreach. People need to see our response in real time.”
Amara didn’t flinch.
“Right now, the stream is a luxury,” she said. “Food, shelter and medical access are essentials. I
can bring the stream back at the cost of higher risk to those. I recommend we keep it degraded to audio only, or even offline, until we’re stable.”
Silence. A small one, but a powerful one.
“Is that strictly necessary?” another founder asked.
Malik cut in, voice measured. “If we push video back to full quality now, we’ll create more
surface for the attacker to exploit. They’re already dancing on our edges. This would be like
throwing open the doors of the cathedral while the fire’s still in the walls.”
The council had voted on doctrine, budgets, and public statements. They had not often had to
vote on whether to trade prestige for survival in real time.
“We defer to the incident commander,” the chair finally said. “Streams remain limited. Make
sure the message gets out through other channels.”
Nia had been ready. She nodded. “We’ll carve a path through text, audio and phone,” she said.
“People don’t need the stage. They need the doors.”
The Dragging Siege
The attack didn’t fade, it dragged.
By the second night, the dashboards were mosaics of red, the kind of red that bleeds into the
edges of your vision. Response times didn’t spike anymore; they knelt and stayed there.
Clusters that had been rebuilt at dawn were sagging again by noon and dead by dusk.
The network felt like a chest that knew how to inhale but had forgotten how to exhale.
Malik watched the lines on his screen the way a cardiologist reads murmurs. “They’re rotating
sources,” he said. “When one pool of machines gets tired or blocked, a fresh one arrives. New
networks, same choreography. Whoever is directing this is patient.”
Amara’s shoulders were a line segment. “Hold the containment plan,” she said. “Critical services
first.”
From a speaker in the ceiling, an executive’s voice cut through the dull hiss of cooling fans.
“Critical includes donations,” the voice said. “Donations keep the rest alive.”
Silence followed, the kind that changes the temperature of a room.
Nia, who had once written about disasters before she started managing communications for one, set her pen down. “Access to shelters and clinics is being slowed, so payments can keep
flowing,” she said evenly. “Is that really the stance we’re taking?”
The answer came after a breath. “That’s the stance,” the voice replied. “We call it necessary
prioritization. No need to put that in writing.”
Amara didn’t argue. That wasn’t her job. “Ease up on the brakes for shelter access,” she told the
team. “Give direct lanes to the phone numbers we trust. Volunteers at the doors pass names
straight to us.”
They did it, reluctantly but exactly. The system still wheezed.
Damage Accounting
Day two began with a meeting nobody had the energy to pretend was neutral. The boardroom
had glass walls and a view that suggested excellence was a law of nature. Inside, the talk was all ratio and runway.
“Donations are down thirty-two percent day over day,” someone reported. “Refunds and
chargebacks are up in equal measure.”
“Recruitment interest is flatlining while the stream is degraded,” another said, tilting a chart until the losses resembled gentle hills instead of cliffs.
“What about shelters?” one founder asked, too lightly.
Nia answered. “Longer waits. People were turned away during the worst windows yesterday.”
“That’s unacceptable,” the founder said in a tone that made it sound like a public relations
problem.
Amara spoke for the first time. “If you want the shelters to be invulnerable, we can build them
like bank vaults,” she said. “But bank vaults slow everything else. Choose.”
They chose revenue.
“Keep the donations portal breathing,” the chair said. “Recruitment programming resumes as
soon as the stream is stable.”
Afterward, in the hallway outside the board room, Malik leaned against the wall as if he was
about to collapse. “We started with human priorities,” he said. “Now we’re triaging for optics.”
Nia met his eyes. “We always were,” she said. “We just wanted to be wrong about it.”
What Obedience Sounds Like
Obedience on the operations floor made a soft, mechanical sound: keys pressed, rules adjusted, limits quietly nudged. Engineers who had come to the Assembly because they believed in service found themselves implementing orders that made their hands feel older.
“Limit retries on shelter requests to one,” Amara instructed. “No infinite spinning. Fail fast with
a phone number and a promise to call back.”
Frida in the help center took another call. The voice on the line was small and steady and tired.
Frida’s screen said the system had failed fast, exactly as designed.
“I’ll put you on a verified list,” she said. “You’ll get a call.”
“From whom?” the voice asked.
Frida looked up at the clock as if it might answer. “From me,” she said, and meant it.
The New Angle
The attackers changed tactics again. The flood began to curl around the weak spots: an old login system no one had updated in years, a rented calendar tool the Assembly barely thought about, and an outside messaging service that was “not our problem” until suddenly it was.
If the Assembly closed ten doors, the flood found the eleventh and knocked politely until the
wood split.
“We can ride this out,” someone said from the founders’ channel. “We have the budget.”
“It’s not budget,” Malik replied before he could stop himself. “It’s bone, it’s marrow. We’re
scraping what keeps the body standing.”
Amara heard it and didn’t correct him. “Run the brownout deeper,” she ordered, and explained
for the one executive still on the bridge: “A controlled dimming. Not a blackout. We turn down
everything ornamental, so the core doesn’t die. No images, minimal scripts, audio instead of
video. We keep the shelter phone lines lit even if we have to route around the entire internet to
do it.”
“People watch our stream for hope,” the executive said.
“People need doors that open,” Amara said, and moved on.
The Numbers We Don’t Publish
The incident log grew long enough to be a book no one would read twice. In a margin, someone
had written in block letters: DAMAGE IS NOT JUST TECHNICAL. COUNT EVERYTHING.
It stayed up even after the screen saver kicked in and back out.
Malik created a private page on the dashboard titled “Shelter Hurt.” It listed the families delayed,
the volunteers locked out, the workarounds that succeeded or failed, the names and times when
phones made the difference that software hadn’t.
He didn’t show it to the board. He showed it to Frida and the help desk floor leads.
“If we’re going to call this prioritization, we should be honest about what we prioritized,” he
said.
Nia glanced once and looked away. “If we publish this, it will be a confession,” she said.
“Maybe that’s what courage looks like,” Malik answered, too quietly for anyone to hear.
“Saying it once and living with the echo.”
The Briefing That Didn’t Make the Stream
The Assembly scheduled a live update for members, promising transparency and resilience.
The stream still couldn’t carry full video; the audio feed carried words like a torch carried
smoke.
“We condemn unlawful attacks,” a founder said, voice smooth as glass. “We’re working
tirelessly to restore the experience you deserve. Remember that your generosity powers our
shelters and clinics.”
In the back of the room, Nia mentally drafted the version closest to the truth: We prioritized
revenue because revenue is what we mostly care about. Revenue buys us power, influence,
buildings jutting into the skies and endless followers, ready to sacrifice whatever is asked of
them. Revenue buys us rooms in serious buildings, the kind with marble floors and soundproof
doors, where our power multiplies in silence. We should be rebuilding in a way that doesn’t
make poor people wait for donors to refresh a page. But our priorities have always lived
elsewhere…
She didn’t publish it. She knew she could never…But it felt strangely liberating to at least
pronounce the truth internally, to have the courage to acknowledge it if only within.
She deleted it in protection of her job and life stability, and in probably somewhat naïve hope to
be able to make a few changes after the lights came back. Hope, not big enough to bring fire
down on her, but just enough, scattered here and there, to make the place just barely survivable
for her conscience.
The Edge of Enough
By the fourth morning, the siege felt like weather the city had learned to live under. The graphs
stopped shouting not because the Assembly had won, but because the attackers shifted their
attention. New patterns appeared in upstream provider logs; a different institution, across the
river, started to limp.
“Don’t call it recovery,” Amara told the team. “Call it ‘the part after being broken.’”
They dragged systems back to something like normal. The shelter portal was given more
headroom. The donation flow, ironically, stabilized fastest. The stream returned to low-
resolution video with an apology that blamed the internet without naming anything more
specific.
The founders sent the operations team pastries and a signed card. The card had a verse about
trials refining character. Someone slid it under a monitor and used it to steady a wobble in the
desk.
In the wash of near-tranquility that follows a long storm, everyone heard the same small thought: we did our jobs. Right next to it was another: we did not get to choose what those jobs were for.
After-Action, Before Truth
They gathered for a first pass at the after-action report. The room smelled like markers and a
fatigue that had gone flat.
“Root cause,” someone said.
“External actor,” Malik answered. “Application-layer denial of service. Coordinated, research-
driven. They knew our edges better than we did.”
“Mitigations,” someone else prompted.
“We need smarter brakes, not just harder ones,” Amara said. “Better anomaly detection that
understands human patterns instead of just machine patterns. Reroute plans for shelter and clinic that don’t depend on our main stack at all.”
“Communications?” All eyes went to Nia.
“We told the truth sparingly,” she said. “We need to set expectations that during an attack some
things will be warped. And we need to stop saying ‘your donations are safe,’ if the truth is ‘your
donation may fail, but we will try again.’ People can survive honesty.”
“Findings for the board,” the chair of the meeting said, and everyone felt the pivot like a plane
banking.
“Donations dropped and then recovered,” someone recited. “Recruitment metrics dipped; we can compensate with targeted programming.”
“What about shelters?” Malik asked.
A thin smile: “We’ll include a note about lessons learned. The story is resilience.”
“The story is cost,” Malik said, but the meeting had already moved on.
What They Keep
When the operations floor finally settled into its ordinary hum, Amara walked the aisles like
someone counting survivors after a storm. Screens back to green, fans steady, people upright by habit.
She stopped by Malik’s desk. He had left Shelter Hurt open on a secondary monitor; numbers
arranged without rhetoric. She didn’t tell him to close it. She didn’t tell him to publish it either.
“We’ll rebuild,” she said.
He nodded.
“Better defenses. Cleaner paths. Fewer places to hide a bad decision.”
“Will we rebuild the part where money outranks beds?” he asked, and made it sound like a
question to the air.
Amara didn’t answer. She didn’t have the right words for it.
Downstairs, Frida finished a follow-up call with a family that had slept in the intake chairs,
because the portal timed out at midnight. She booked them a room for a week. They thanked her, as if she had rebuilt the building with her hands.
On the website, a banner returned: We Are More Than Our Stream.
It wasn’t wrong. It wasn’t true enough.
The Doorway Between Parts
The Assembly’s systems stood again, patched and braced, the way a fighter stands after a count of nine. The founders planned a weekend of programming about perseverance. The shelters counted blankets. The clinics re-stocked supplies. The help centers checked their phone trees twice.
The city exhaled as if the weather had changed back.
It hadn’t. It never does. Nothing goes back. It only moves on.
The depiction described here is fictional and does not represent a real attack, organization, or incident.
