Coin miner trojan - help needed

A web server I do admin work on seems to have a bitcoin miner trojan installed and I can't seem to find where it originates.

From time to time (it is not continuously) several processes are being spawned by the web server user account ('www-data') similar to below:-

www-data 7116 0.0 0.1 485004 140168 ? Ssl 00:11 0:00 ./htop -a yescryptR16 -o <IP ADDRESS>:6333 -u qpkg4fgnh8a0hhzd2z9g80g4d09j6qnt0sth6l8x7z -p x --cpu-affinity 0x3 --cpu-priority 5 --backgroun

www-data 7406 0.0 0.1 485004 137536 ? Ssl 00:12 0:00 ./htop -a yescryptR16 -o <IP ADDRESS>:6333 -u qpkg4fgnh8a0hhzd2z9g80g4d09j6qnt0sth6l8x7z -p x --cpu-affinity 0x3 --cpu-priority 5 --backgroun

www-data 7689 0.0 0.1 485004 138324 ? Ssl 00:13 0:00 ./htop -a yescryptR16 -o <IP ADDRESS>:6333 -u qpkg4fgnh8a0hhzd2z9g80g4d09j6qnt0sth6l8x7z -p x --cpu-affinity 0x3 --cpu-priority 5 --backgroun

I have used iptables to block the IP address and have run rkhunter and chkrootkit but they don't report anything abnormal.

Anybody seen across this trojan before?

EDIT: After reviewing the web server logs for 20/03 I believe I have found and removed the hole/exploit (I'm not sure if I am allowed to post the details here so I won't) many thanks to everyone who responded!