I'm probably cynical..
.. But I'd bet a substantial sum that this is the same scrotes who were responsible for the last intrusion (operating under another name of course).
Once you are in once, it's very easy to install a couple of other backdoors to let you back in later.
All the more reason, not to pay those ransoms folks...