Identity logs show many municipal accounts receiving one or two failed logons with the same common password, then quiet periods, rather than thousands of guesses against one account. Which attack pattern is this?

Password spraying uses a small number of likely passwords across many accounts to evade per-account lockout thresholds. Classic brute force focuses intensive guessing on one target. RFID cloning and rootkits are unrelated physical and concealment techniques and do not match distributed low-volume authentication failures.