Track down insecure plugin

Hi. Client WP website got hacked by cryptocurrency miners. Website is running a hodgepodge of old and new plugins, all as up-to-date as possible, but some of them legacy, and I suspect one of them let the bad guys in. Question is, which one?

Intruders set up a root user crontab that downloaded perl mining scripts. I deleted the crontab and blocked all the outgoing urls and IP addresses, so if they try the same attack again, it wont work. But obviously that doesn’t prevent them from doing anything else they want with root access to the server. So, question is, how do I figure out which plugin got them root access to set up the crontab?