We are seeing another wave of attacks, where attackers try to guess the passwords of the malicious users being inserted in the previous exploitation phase.
Requests are made upon the XMLRPC interface "/xmlrpc.php" and look like this :

wp.getProfile

9999
t2trollherten
0rt8Ka7slborUi