In my personal experience working as a pentester, unless I was specifically targeting your account, the dictionaries I typically use when brute forcing lists of user accounts generally covered a list of common dictionary words, common 1337-style number substitutions (3 for E e.g.) and SOME common phrases.
Hackers and security groups actually do statistical analyses of actual passwords (like those disclosed from data breaches) and use the results to add new passwords to the list of passwords to use.
If I am specifically targeting your account, then I use more complicated password generator options, like simple dictionary, compound dictionary (putting 2 or more words from the dictionary together), 1337 substitution, or other common tricks, like I'll have each password tried with a ! at the end as this is the most common location to put special characters, and this is the most common special character.
I see dictionary word as substring as less of an issue than far more common password weaknesses. The three biggest things you can do to increase the security of your password is to:
- mix in multiple character classes (upper, lower, number, special chars)
- LENGTH!! (min. 9 chars)
- Don't use secure passwords on insecure sites (so that wellsfargo != sony :-) )