A security analyst reviews authentication logs for a company's public-facing web portal and notices thousands of failed login attempts across many different user accounts, each account tried only a handful of times before the attacker moves to the next. The source IPs rotate frequently, and a small percentage of logins eventually succeed using valid username/password pairs that were never reset after a breach at an unrelated third-party site. Which type of attack best describes this activity?