The flaw that was reported in CUP Discord was that the Reforger Workbench tool's scripts can delete files on the filesystem (which is somewhat intentional as IDE plugins should have access to files on disk).

That is completely different than a reforger dedicated server (which is not the workbench tool) allegedly installing malware, also you didn't mention that you installed mods, did you? If so, which?

Programmers are aware of the security implications of it, which is why that type of access is disabled in normal client/server, its only in tools.

This sounds like its a different issue, but nevertheless this will definitely be investigated.

Edit: User clarified that they indeed were not running any mods, and were running dedicated server which is not affected by the mentioned workbench tools security issue. There is something else going on.

This should be closed as invalid.

while running Reforger in admin mode

WHY would anyone ever do such thing? A simple game server should never require to run with elevated privileges. All "run as admin" does is to solve some permission issues - so the actual root cause surely is not Reforger or the workshop but obviously some bad permissions somewhere else.
Also:

a server box

A regular Windows 10 CLIENT should not be run as "server" - not even if you host something on a local system at home over your private internet access. It's fair to assume quite a lot of mis-config along with improper permissions are the real cause to whatever happened.

In addition: No matter if workshop or something in-game - if you run others code there's always the potential for malicious stuff. The new approach BI gone here comes with its risks - no doubts - but it's unlikely that this has caused the claimed attack.

We have investigated the issue.
And as expected, clients and servers don't have the file access issues the reporter described, and the user also wasn't running any mods that even could access these functionalities.

What is left is "My server was ransomware infected, and I had a Reforger Server running on it"
We have no indication that it was caused by reforger, also this seems more like a large scale attack using known vulnerabilities in some commonly used software. Our barely 3 day old game would just not be an attack vector for such a scheme.

If someone has anything more concrete we will of course investigate it, but so far there is nothing here.