I would be surprised if this was an expert attack. I suspect you've been socially engineered into giving someone Remote Access. Getting past your router's firewall is not trivial & can best be initiated by something on your own computer than from outside.
Also, an expert attacker would be unlikely to use an attack vector which would let you simply see what they're doing. With the necessary permissions it would be quite easy to do all of this without you knowing anything other than the fans had activated.
I do this legitimately to access many Macs on my network & remotely around the country.
Disconnect from the internet. Unplug or switch off your router.
Check your router's instruction manual for how to reset it to factory defaults. Reset then change the passwords of both admin access & the wifi password. Set them to two different passwords.
Check if it has UPnP capability & if it's possible to switch this off. If so, switch it off.
If the attacker can still get in when your router is switched off, then they must be within 50 feet of you, directly accessing your iMac's wifi.
If so, disable the wifi on the Mac & wire up to the router directly, with an ethernet cable.
Check your Mac accounts.
System Preferences > Users & Groups
Click the lock, supply your admin password, then change your passwords on all known accounts.
If there are any accounts there you don't recognise, remove them by clicking the - box bottom left.
Several legitimate remote access apps add their own user here, for example, NoMachine adds a user called
nx. If you installed such an app, you would allow this to be enabled. If you didn't & someone else is using it to access, removing it will seriously hamper their attempts.
Don't remove or disable Guest.
System Preferences > Sharing
Disable Remote Login, Management & Apple Events.
In fact, unless you know you need them, switch off everything in this panel.
Install & run Malwarebytes
Check your Applications folder for anything you don't recognise. Look for names such as TeamViewer, NoMachine, Ammyy Admin, Mikogo, AnyDesk, Chrome Remote Desktop, WebEx Meetings, ThinVNC, UltraVNC [or anything with VNC in the name].
If you find any of these, get AppCleaner (Freeware) then drop each one onto it & let it uninstall each one.
Login to https://www.icloud.com/find/ then click All Devices.
Make sure you recognise & know the current whereabouts of all the devices in the list. If there are any devices you cannot identify, click on them & 'remove from account'.
Any device you recognise but cannot locate in the house, set to Lost Mode.
Login to https://appleid.apple.com and change your Apple ID password.
If that doesn't lock them out, there's something more stealthy going on & you will need to refer it to an expert, hands-on.
Encrypting the drive will have no effect on this type of attack, because it's unlocked by your own account being logged in.