This is a defacement attack conducted by Xtroj-EnTn. Most likely Hmei7 has something to do with this team as some of the Xtroj pages refenrece pages defaced by Hmei7.
Hacked sites usually contain files like Joker.html, xtroj.html, bl.html, X.php.
Affecting
Any web site (no specific target).
Cleanup
Restore your site from a clean backup. Deleting all files first is the best option since it will delete all backdoors and other malicious files that
hackers could leave on the server. It is important to identify and close the security hole to prevent recurring attacks.
You can sign up with us and let our team remove the malware for you.
Dump
...excerpts from a typical defacement page...
<html><head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252"><title>hacked by Xtroj EnTn</title></head><
...
H.criticalImagesBeaconInit=H.l;})();pagespeed.criticalImagesBeaconInit('/mod_pagespeed_beacon','http://www.joomladaypr..ue.org/j.htm','KgOnfXS5Vb');
...