Password spraying
A few common passwords, a lot of accounts. Misses lockout, hits whoever used SeasonYear!.
Password spraying tries a small set of common passwords across many accounts, slowly enough to dodge per-account lockout. It is brute force with manners.
Ban known-bad passwords, require MFA, watch for low-and-slow auth failures across the directory, and stop exposing password login to the whole internet when you have a better option.
Fact source: ASD's ACSC glossary.