In reply to Miroslav Glavić.

Seeing as they used an old SSH password, I would add to your list: audit all passwords to make sure there’s nothing lying around they could use.