Thanks for the update

Why did you pick data lake storage gen 1 instead of gen 2?

If you move to the cloud, cross database queries are even slower. (less control where the databases are placed)

Does the VM has Vmware Guest tools installed? Otherwise the VM is slow because the VMWare host has to emulate everything (hardware etc) with cpu power. Installing the tools:

Thanks for the article.
The code about create or alter , just before the nocount section, mentions "drop if exists" instead of "create or alter"

You may find a lot of articles made by Koen Verbeeck.
Like trying out the auto adjust buffer size https://www.mssqltips.com/sqlservertip/4221/improving-data-flow-performance-with-ssis-autoadjustbuffersize-property/

my goto place for oracle is http://www.orafaq.com/
Quite a responsive forum when you provide the necessary information

An active blog: http://www.oaktable.net/feed/blog-rss.xml

Pro's of seperating ssrs from database server:
More resources available for the database
More control of resources used. Resource management in SSRS is limited
Possible to reboot SSRS without impacting...

You can explore powershell for managing security etc
https://www.sqlshack.com/managing-ssrs-security-using-powershell-automation-scripts/

Maybe it is not your database but your web/app frontend that got hacked?
Your website might execute an addional javascript to provide the tampered content or reroute requests?

cost of threshold is 5 -> any reason for this low number?

A picture would be handy.
Are the constraint lines full lines (all success) or dotted (any success)?

Thanks for mentioning Microsoft's SQL Server Database Experimentation Assistant. Didn't know the tool existed

1.Is it possible to have another server next to the domain controller? Many products refuse to install on a domain controller.
2. Licensing: SQL Server 2017 licensing guide....

When using the oracle oledb driver, make sure to try some batch/buffer memory sizes. Currently working with batchsize 5000 instead of the default.