@Mike

Your description of this pattern of activity sounds a lot like the recent high-profile reports of a large-scale bot-net attack on WordPress servers.

These attacks are looking for WordPress sites that use 'lazy' usernames and passwords for their login. They just go down a list of common 'stupid' login words, trying them one after another, brute-force fashion.

If they succeed, then they quietly go about infiltrating the server, and discretely integrate it into their bot-net. They may well do "nothing" with the newly-acquired zombie, right away.

In the case of a related network of websites & servers, be aware that a standard tactic will be to continue to noisily hammer one site or server, after a different one has already been successfully compromised.

The idea in this is, to keep Admin's attention on the ongoing attack, and off the other server-logs .... where it might upon closer examination be noticed that weird things were or are going on.

Logs for other sites should be examining, for a pattern of attempts that went on for awhile, but then stopped. Attempts that stop, may indicate success.

There are now resources to scan servers for the embedded malware.

(It is part of the 'MO' of these bad guys, that you don't "lose" a site ... that done right, you don't notice anything. That's exactly the intent.)