Either preceded by a port scan or just blasting away, the miscreants' likely plan is
Try for likely user names, hope for guessable password
Keep guessing until successful
PROFIT!
They usually come in faster than most of us can type, so