It's not a given that brute forcing is the strategy the attacker would choose. That might just lead to their Tor & VPN IPs getting quickly blocked, if they aren't already. There are only around 1500 Tor exit nodes and it's trivial to block them. Sometimes trying to stay under the radar might be the smarter choice.

Anyway, we still have no idea what the scale of the attack is or when exactly it started (IIRC someone reported this happening much earlier this month).