We have a few sites hosting on a Media Temple (MT) shared server. This morning, we noticed that some of our website were down. Upon investigation, we realized that they had been compromised. The directory structure for MT is as follows: domains>DOMAIN-NAME>html(aka website root).
At the DOMAIN-NAME level, we noticed a file named Meuhy.php. MT's support said that it looked like some sort of malicious package manager. I did a Google search for that file, but I didn't find anything that helped identify its source. I did, however, notice that it has been injected on other websites: https://www.google.com/search?q=meuhy.php&oq=m&aqs=chrome.4.69i60l4j69i59j69i60.5768j0j7&sourceid=chrome&ie=UTF-8
At the web root, we found that WordPress code had been injected into the index.php files, however, all of our sites except for one are Drupal sites. We also discovered that a series of .xml files were generated. They contained what looked like to be a series of server calls. We checked the GPU usage, and noticed that it spiked around that that these files were generated. Our Google Analytics also show that traffic spiked abnormally during this time.
My primary question is, does anyone know what type of attack this is, and should we be concerned that our databases could be compromised?