It does seem to me most probably a "culture jamming" thing. However, at face value a ransom attack has a sort of skewed logic to it. AO3 is a donation-funded n

It does seem to me most probably a "culture jamming" thing. However, at face value a ransom attack has a sort of skewed logic to it. AO3 is a donation-funded non-profit and as such its books are somewhat open. The last few years the group (OTW, the Organization for Transformative Works) has been getting donations nearly 2x their operating costs and we know has been building something of a "rainy day fund"/"war chest" with it. (That's mostly to fight the more usual sorts of DDoS AO3 faces, given the content they host: DMCA takedowns and lawsuits.) The alleged ransom notice asks for a relatively small portion of their "rainy day funds" so there exists a possibility it is as dumb as it looks, and they just want what they think can be a quick and simple pay day. But "culture jamming" of some sort and some sort of disagreement with the types of content that AO3 hosts still feels to me like the more likely answer to why this is happening, and the ransom notice a tag-along or something.