I read an interesting article... arg I cant find again. Turns out they start early. Investigate what is on board, is the target high value... and when they pick a high value target, start a deny all service attack, and rob it. There are reports of messing with the manifest to overload or even make them unbalenced to cause havic. Plus catching all the Pokemon at sea was a big tell.