Probably. My understanding is that the attacker installed a rootkit in the system or the kernel, with port-knocking access, which cannot be removed by patching

Probably. My understanding is that the attacker installed a rootkit in the system or the kernel, with port-knocking access, which cannot be removed by patching the original exploit. Well, it's why wiping and reinstalling is common sense for any compromised server.