Hit by 20,000+ spam links

One of my clients has a very large website with about 87,000 visits per month. Up till end of January the 404's in GSC were at about 300. Then, in one day, they jumped up to 27,000 and have been steadily rising. Loads of links with simplified Chinese characters that produce 404 errors. Of course Google says they can spot these issues and an increase in 404's won't affect the site but everyone knows that's crap.

Traffic dropped by 9,000 in the past 28 days.

I'm cleaning this up but I wanted to know if anyone else has been hit by this before?

If you want to see a sample of the URLs and how many sites they are on just do a quick Google search inurl:bzw77

over 16 million results across a ton of sites.

This seems to be a pretty popular tactic among certain Asian territories. They look for sites that haven't noindex'd their search results pages and that don't sanitize their input properly (which includes many Wordpress and Magento sites by default), and hammer links to those search pages with pre-populated search strings. These search strings are usually some keywords and a non-clickable url - meaning that people are actually bothering to type in a url by hand after they've seen some spam in the SERPs, it blows my mind that someone would do this. Anyway, it seems effective enough in some Asian markets that they're still doing it en-mass.

The last time someone asked about this problem I found a couple of solutions for WP:
https://www.getastra.com/blog/911/remove-wordpress-spam-search-results/https://jetpack.com/blog/wordpress-infected-with-seo-spam/
And a plugin for Magento specifically for remedying the issue:
https://www.scommerce-mage.com/magento-2-antispam-catalog-search.html