How do I prevent Remote Access to my Mac?

Question

I think I'm being hacked.
_{(This is a theoretical scenario, based on a real occurrence.)}

I have clear evidence that someone unknown is able to remote access my Mac.
The Mac wakes unexpectedly, the cursor can be seen moving, windows & files are being accessed & opened. The attacker can also be seen accessing the webcam & showing the current view of the room.
My drive is encrypted. Why doesn't this prevent their accessing it?

I don't know whether this is being done from nearby or at a distance. If I switch off my router, they still seem capable of this access.

How do I analyse & prevent this from happening in future?

^{This question is 'poached' from SuperUser, currently closed & showing no signs of being re-opened. As such it will eventually be swept away by the system. Edit March 22 - the post is now deleted. The original question was a paranoid mess, but I thought the answer may be of benefit to Ask Different, so this is a complete recast of the question.}

Answer 1

I would be surprised if this was an expert attack. I suspect you've been socially engineered into giving someone Remote Access. Getting past your router's firewall is not trivial & can best be initiated by something on your own computer than from outside.
Also, an expert attacker would be unlikely to use an attack vector which would let you simply see what they're doing. With the necessary permissions it would be quite easy to do all of this without you knowing anything other than the fans had activated.
I do this legitimately to access many Macs on my network & remotely around the country.

Step 1.
Disconnect from the internet. Unplug or switch off your router.
Check your router's instruction manual for how to reset it to factory defaults. Reset then change the passwords of both admin access & the wifi password. Set them to two different passwords.
Check if it has UPnP capability & if it's possible to switch this off. If so, switch it off.
If the attacker can still get in when your router is switched off, then they must be within 50 feet of you, directly accessing your iMac's wifi.
If so, disable the wifi on the Mac & wire up to the router directly, with an ethernet cable.

Step 2.
Check your Mac accounts.
System Preferences > Users & Groups

Click the lock, supply your admin password, then change your passwords on all known accounts.
If there are any accounts there you don't recognise, remove them by clicking the - box bottom left.
Several legitimate remote access apps add their own user here, for example, NoMachine adds a user called nx. If you installed such an app, you would allow this to be enabled. If you didn't & someone else is using it to access, removing it will seriously hamper their attempts.
Don't remove or disable Guest.

Step 3.
System Preferences > Sharing
Disable Remote Login, Management & Apple Events.
In fact, unless you know you need them, switch off everything in this panel.

Step 4.
Install & run Malwarebytes

Step 5.
Check your Applications folder for anything you don't recognise. Look for names such as TeamViewer, NoMachine, Ammyy Admin, Mikogo, AnyDesk, Chrome Remote Desktop, WebEx Meetings, ThinVNC, UltraVNC [or anything with VNC in the name].

If you find any of these, get AppCleaner (Freeware) then drop each one onto it & let it uninstall each one.

Step 6.
Login to https://www.icloud.com/find/ then click All Devices.
Make sure you recognise & know the current whereabouts of all the devices in the list. If there are any devices you cannot identify, click on them & 'remove from account'.
Any device you recognise but cannot locate in the house, set to Lost Mode. Login to https://appleid.apple.com and change your Apple ID password.

Reboot. Test.
If that doesn't lock them out, there's something more stealthy going on & you will need to refer it to an expert, hands-on.

Additional notes:
Encrypting the drive will have no effect on this type of attack, because it's unlocked by your own account being logged in.