I have to assume they're using some sort of extremely broad, relatively intelligent dictionary attack--a large dictionary, mixing numbers and symbols in with wo

I have to assume they're using some sort of extremely broad, relatively intelligent dictionary attack--a large dictionary, mixing numbers and symbols in with words, trying misspelled words using things like Levenshtein distance, phonetic spellings, etc. In other words, brute force using the sort of mnemonics and tricks that people are advised to use to help them remember a "strong" password. Password strength is a spectrum, and there's a fair difference between "strong enough to make a random criminal go find an easier target" and "strong enough to keep out a determined, funded attacker targeting you personally". Or it's possible that a lot of these suspects just used really crappy passwords. People are silly that way.