Hello,
I gave an answer earlier. I will copy/paste it here.
I terribly sorry that you're going through this ordeal. I see that it happened to you last year and hopefully you got some answers.
I went through a similar situation (still am) and in my case, I found out that someone who had a previous access to all my devices, systems and credentials had created remote access to my systems and was accessing them via VMs (Ubuntu, Kali Linux, RedHat etc...). With a gnome installation and freedesktop.org these criminals were able to get into my routers, my computers, androids and IOS devices.
I changed my router 3 times! Even moved out my apartment! The IOS devices (I believe my iPhone), were even turned into network gateways. I will try to attach some screenshots.
I lived through these horrendous moments, seeing the DDOS attacks happening, the random password changes, the redirect to fake websites etc... but was powerless to do anything. I contacted EVERY single company (Apple, Google, ISP) even apple community to no avail.
I'll add screenshots of a random windows XP (even stranger since Microsoft has not supported WindowsXP in over 10 years) that was connected to my router at some point. I would also see Linux computers logged in.
My own laptop would be connected with the mention "this device connected away from home network" which indicated a remote connection.
Hello
I changed my router 3 times! Even moved out my apartment!
I finally got some answers when I installed my own VMs, learned how to dig into my machines, and was able to find the prior installations, intrusions on my systems (I'll try to add some screenshots).
P-S: Please pay attention to the Google Play Services App on your phones (mine was android) if applicable.
The adversary had installed a fake Google Play Services app on my phone, I noticed it almost 2 years after the fact. It would show as "Parallel Google Play Services". Which made 80% of the apps I downloaded (including pre-installed Google system apps) considered side-loaded. All these apps were accessed remotely and sending data to someone else. Some of them (Gboard) were even used audio recording apps and apparently were sending these recording somewhere.
My iPhone seemed to be remotely managed (I never understood that one) and at some point, my very simple access code, just stopped working. I had to reset factory the device, and strangely enough, even after the rest, Google accounts, that are only signed on one device and one laptop, have several sessions opened on iPhones with my name, and some without my name are opened.
It's a real nightmare.
Best of luck! 