Restoring the system will NOT automatically protect you, even with a patch. It's somewhat likely they may have been in your system for weeks, which means backups for weeks are compromised. 

I'd be looking to restore you from Mid Jan, and then restore data only for that. You also need to assume every single password in your organization has been compromised and they may have footholds in places you don't think are likely. 

If you do not get this done properly, they will almost certainly get another go, which is going to be misery on top of misery. 

@hatch I don't know about your IT team, but I think they should be consulting with experienced external support to ensure you don't end up dealing with this again in a couple of weeks. 

You also need to understand, it's more than a little likely, your data has been exfiltrated and they may use that to further blackmail you, or to target your customers suppliers and contacts. 

Depending on the size of your operation, the safest option would be a new clean server setup with a new domain and restore only data.