I always wondered who is behind these attacks, they don't seem targeted since they do them on random ips. I did a bunch of Devops a few years ago on a Startup

I always wondered who is behind these attacks, they don't seem targeted since they do them on random ips. I did a bunch of Devops a few years ago on a Startup, and whenever i started a new AWS EC2 instance, i started getting request for Wordpress files, and other common CMS files.