Cleanup needed: Hacked Hostinger VPS (4 small WordPress sites down, malware infection)

I have a VPS hosted on Hostinger (Ubuntu, nginx, MySQL, PHP) running 5 to 6 WordPress sites that has been compromised. Sites are intermittently down or throwing inconsistent errors on load, which strongly suggests active malware or infection rather than a config issue. I have clean UpdraftPlus backups, so restoring from a known good state is not a concern. My priorities are getting the server properly hardened and the sites restored and running again on Hostinger. I need an experienced sysadmin to: 1. Diagnose the infection and identify the entry point 2. Clean the server or rebuild it on Hostinger, whichever is safer given the findings 3. Harden the server against reinfection (firewall, fail2ban, SSH lockdown, file permissions, WordPress hardening) 4. Restore the WordPress sites using the offsite UpdraftPlus backups (files and database together, not just files) 5. Rotate all credentials (SSH, MySQL, WordPress admin, Hostinger account) 6. Brief me afterward on what happened and how it was hardened Requirements: - Proven experience with malware and incident cleanup on Linux VPS, not just general server setup - Comfortable with nginx, MySQL, PHP, and WordPress specifically - Experience with UpdraftPlus or similar WordPress backup plugins - Please describe your diagnostic approach before restoring, since I want the entry point identified so this doesn't happen again after restore Access provided: Full SSH and root access to the VPS (staying on Hostinger). Budget: Looking to keep this in the $150 to $200 range if possible, but open to discussing scope if the situation requires more. Please let me know upfront if you think this job realistically exceeds that, I would rather know before we start than mid cleanup.