Okey, let me guess: you’re here thanks to Google? :-) You used it after finding how your website was upgraded with text ”Hacked By BALA SNIPER”, that being sprinkled all over the place. Here are my observations about what Bala Sniper does: a) the hacker will crappify your WordPress-powered website’s site name and slogan, b) he will also change the encoding for page and feeds to
27 December 2016: It’s possible that this Bala Sniper is actually a hacker team from Kurdistan, whose aim is to — somehow — work towards independent Kurdistan state.
29 December 2016: Looks like many hacked sites had newest WP version installed. Many hacked sites are from Sweden, Finland, Germany.