This attack is actually not hard to detect and defend against, just limit each XML-RPC request to one login attempt. Here is a wordpress plugin for that - http://shop.marksw.com/downloads/xml-rpc-brute-force-amplification-attack-cure-plugin/