Same issue with tampered files but we didn’t use or have FOP2 installed.
config.php was deleted and needed to be restored. I also had to force install a number of modules that had been tampered with like Framework, API, contact manager and SmartOffice.
It’s working now, but I want to know what they were after and should this server just be restored from backup? I don’t want to keep it running if they installed something.