I agree with the DDos assessment. Appears the "handlers" in the diagram are the botnet servers the attacker is using to connect to its compromised devices to launch the attack.