Anatomy of Attack on sites in unknown. All sites belong to the same server with the same IP with same CMS(Content Management System) which is Joomla. It looks like hacker bruteforced one of Joomla user and upload shell on the server or used some 0 day which enable hacker to get into the server and defaced these sites.
Hacked Sites:
http://yamaha-motor.ba
http://yamaha-motor.hr Croatia
http://yamaha-motor.me
http://yamaha-motor.mk
http://yamaha-motor.si
http://yamaha-motors.rs Serbia
Mirrors of the Hacked Sites:
http://www.mirror-ma.com/mirror/id/216516/
http://www.mirror-ma.com/mirror/id/216515/
http://www.mirror-ma.com/mirror/id/216514/
http://www.mirror-ma.com/mirror/id/216513/
http://www.mirror-ma.com/mirror/id/216512/
http://www.mirror-ma.com/mirror/id/216511/
Deface Message:
Hi stupid !!!!!
This site has been hacked by Dark Snipper
DONT worry … you are not alone in this server …
and we have been just changed your index …
Remember hacking is more than just a crime. It’s a survival train
…Don’t think that hacking is wrong….there is no right and no wrong …
for free palestine
At the time of writing, All sites were restored !