The attack was very simple, basically scanned all sites hosted there for wp-config.php with the wrong permissions. If it found, got the db information and modified it.