I've noticed these attacks are looking at the author slug to guess usernames. I've been using a plugin to change the author slug, the Limit Login Attempts plugin, and Google Authenticator to beef up security. I've also been trying out Clef, a two-factor auth plugin that just added the ability to remove the user/pass fields from the login screen completely. No login fields shuts down a brute force attack pretty effectively.