While mitigating link-flooding attacks on the Internet has become an essential task, little research has been done on how an attacker can further attack and abuse the mitigation solutions themselves. In this paper, we propose a two-wave attack with collateral damage of millions (or Carom), a new link-flooding attack that poses a mitigation dilemma for multiple simultaneously attacked networks, which must either endure the flooding attack or suffer unwanted side effects in mitigating the attack. Composed of practical components, the Carom attack aims to maximize the burden on attack mitigation systems and the collateral damage to defending networks, thereby wreaking havoc on large swaths of the Internet. After modeling real-world mitigation solutions, we evaluated the attack against the mitigation solutions with real-world datasets, showing the feasibility of the attack and quantifying the amount of damage it can inflict on today’s Internet. We hope that this work can motivate the improvement of existing link-flooding mitigation solutions.