Thanks to Rick I think the problem has been discovered and corrected. It appears there were some exploits left that weren't discovered after the phishing attack and they probably used those to open a back door and destroy everything. Files removed and all should be good again. Thanks Rick!
