Well since its a botnet that is trying to login with lots of different passwords and lots of different accounts its fairly obvious what the attack vector is. That's also why its safer to force a password reset than to just continue to reset passwords after they get compromised.