Expert WordPress / Linux Malware Forensics Specialist Needed — o2switch Compromise

I have a compromised WordPress website hosted on o2switch and need an experienced cybersecurity specialist to investigate and fully clean it. This is more serious than a typical WordPress malware infection. I have found evidence of two GSocket (Global Socket) reverse-shell backdoors, including persistence through .bashrc. There was also a PHP webshell. The attacker appears to have had shell-level access to the hosting account, and previous password changes and WordPress cleanup did not remove the backdoor. What I need I want someone to: Investigate the compromise before deleting anything Determine how the attacker originally got in Identify all backdoors, malware and persistence mechanisms Review relevant o2switch/cPanel and website logs Determine whether the attacker still has access Build a timeline of the attack Preserve important forensic evidence Then completely remove the compromise Advise whether the WordPress site should be cleaned or rebuilt Help secure the site so it cannot happen again I am particularly interested in someone with experience in: Linux server security WordPress compromises Malware/webshell investigation GSocket / reverse shells cPanel / shared hosting Incident response and forensic investigation Important: Please do not simply run a WordPress malware scanner and delete suspicious files. I specifically need someone who can investigate how the compromise happened and whether there is any remaining access. Please include in your proposal: Your experience investigating compromised WordPress/Linux servers Whether you've dealt with GSocket or reverse-shell backdoors Your experience with o2switch/cPanel How you would approach the investigation before deleting evidence Your hourly rate / estimated hours I can provide the suspicious files, timestamps, investigation notes and available logs.