As a tip for the future, in case you're interested: you can use hn.algolia.com, search "sudo", time window something like "past month", and you'd have found it.
hn.algolia.com is a great resource and I'm certain not everybody here knows about it.
Though they would have had to also get into the admin server running (probably) WHMCS.
The sudo bug would let a hacker take over a server where the customer code ran, but not the main admin server. They would have needed some other weakness to get that. Perhaps aided by owning one of the customer servers.
https://www.linux-magazine.com/Online/News/Decade-Old-Sudo-F...
Edited to add: Here's another article about it (you should be able to find quite a few more, too):
* Wed Jan 20 2021 Radovan Sroka <rsroka@redhat.com>
- 1.8.23-10.1
- RHEL 7.9.Z ERRATUM
- CVE-2021-3156
Resolves: rhbz#1917729It's even possible that while this seems to be a very likely attack vector that the attacker used something else. One place to look if they had a billing system hit and all their hosting systems is if maybe the billing system got breached first. There are automated provisioning and C&C things built into, say, WHMCS or WHM Autopilot that would be an ideal vector to all the hosting servers if someone breached the billing and provisioning system first.
I don't know how many different individual hosting systems we're talking about. Having a user account to use the sudo vuln on each and every one of them and then also breaching the billing server seems unlikely. It seems more likely the centralized tool was taken over (perhaps using one or a few hosting systems as a springboard) and used to spread to all the hosting systems automatically.