Brute force attacks continually on my site

I am getting brute force attacks constantly on my site. It appears to be the same hacker or bot because the usernames and passwords are identical, but the ip address changes every time. Is there a way to stop these attacks?
I already have a captcha on the login form which I thought would be able to stop an automated program from attempting to brute force hack in.

https://wordpress.org/plugins/sucuri-scanner/