The server was hacked. They staged an email phishing attack by placing their scripts and a landing page with us. What is the algorithm of actions?

Question

System administration

The server was hacked. They staged a phishing attack by email by posting their scripts and landing page.
I understand that they collect bank data. I really want to nip in the bud.
Weak in administration.
They have access to one of the accounts. This is from the obvious.
There are 3 online stores on the server.
Are my thoughts about the algorithm of actions correct? 1. Go through https://revisium.com/ai/
with an aibolit through the sites of the infected account (there are 2 of them) 2. Set stricter rights to folders and add protection to htaccess (CMS Magento) 3. Clean out backdoors 4. Update software What else is worth do? (perhaps you will recommend a console antivirus, perhaps you will recommend a firewall or something else)
If you need more information,
please ask for it in the comments to the question,
not through the answers.
-------------------------
Ubuntu 14.04.3 LTS
ISPmanager Lite 5.31.1

Answer 1

pay admin $$.