South African cyber security experts warn that low ransom DDoS attacks on ISPs may stem from cheap dark web tools, or sophisticated actors testing infrastructure resilience.