Anatomy of attack is not known but the hacker managed to upload shell on the server and mass defaced the whole websites on the server.
The hacked sites belong to different hosting servers with different IP addresses. There is no specific reason mention by the hacker on the deface page. It seems that hacker rooted the hosting servers as mentioned on the deface page.
Most of the websites are still defaced with the file 4li.txt added on each website. Hacked sites link can be found below.
Hacked Sites Link:
Mirrors of the hacked sites: