Watching failed password attempts across the board is a simple metric. Correlate that with the ips responsible for the sudden increase and you have a starting point for your investigation and remediation.