Need help recovering organic traffic after a PolyShell attack

Hi all, looking for advice from anyone who has handled SEO recovery after a PolyShell attack.

As I understand it, PolyShell is a malware/backdoor attack where malicious PHP files/scripts get injected into a website, which can create spam pages, redirects, hidden URLs, or other compromised behavior. Since this happened, our site’s organic traffic has dropped sharply.

I’m currently checking:

• spam/hacked URLs in Google index
• Search Console issues
• crawl/indexation impact
• possible redirects/injected pages/server-side malware

Would love advice on the right recovery order from an SEO perspective:

1. full malware/server cleanup
2. remove/deindex spam URLs
3. 404/410 vs noindex/robots decisions
4. GSC removals / sitemap cleanup / reindexing
5. monitoring recovery signals

If anyone has been through this before, what worked for you, what did you miss initially, and how long did recovery take?