How can an attacker change data in the ISPManager from the outside?

Question

Task Schedulers

Good afternoon, the problem is as follows:
Somehow, yesterday, attackers gained access to the ISPManager control panel.
As a result, the /var/tmp/NTEbHhe >/dev/null 2>&1 entry appeared in the cron scheduler,
which is executed every 15 minutes, and also, all entries from "Access restriction" have been removed.
The paradox is as follows: entries in the access restriction, I added 16.04 .15, we looked at the hosting logs, but there are no deleting records and adding cron tasks in the logs, i.e. logically, the changes were not made from the ISP. How is this possible?
And yet, what could the added entry in cron mean? The tmp/NTEbHhe directories are outside my account and I am not root.