Spanish authorities announced an arrest tied to alleged DDoS-linked activity, and the case points back to a familiar cybercrime pattern: disruptive traffic, loose attribution, and hard-to-verify group branding.