Typo patrol:
Going by your detailed description of the many things that the intruders changed and broke, it may be way too late to figure out for sure what the avenue of entry was. However, if you really _were_ running a 15-year-old Linux kernel, then don't forget that the public attack service includes the network stack -- and CVEs for the kernel get
^^^^^^^ "surface"
ignored for 15 years at your peril.