Please understand the problem. Calling them "Hackers", or "Black hats" or whatever fucking term is NOT the issue.
When someone has the possibility of doing a Sybil attack, no matter what they did before, you take that shit seriously. As of now, we don't know if the goal is to really test their 0day (which, if it's a Sybil isn't exactly 0day) or just popping up 3360 exit nodes to give "free" bandwidth.
Given that they've yet to do anything beyond DDoS attacks that aren't even complex in nature - the odds of them having a 0-day or any attack of any sort is pretty much 0. This is literally one or more teenagers "doing it for the lulz" and the attention.
When someone has the possibility of doing a Sybil attack, no matter what they did before, you take that shit seriously. As of now, we don't know if the goal is to really test their 0day (which, if it's a Sybil isn't exactly 0day) or just popping up 3360 exit nodes to give "free" bandwidth.