Seems like SN_BLACKMETA is behind the attack..
source
@jupiter @textfiles