An attacker successfully infiltrates the LAN and infects a device that acts as a future bridge. Once inside, the infected device can communicate with a malicious source outside of the local area network. We assume that only one device is infected and that the malware is located anywhere in the computer but it's unable to migrate to other devices in the same LAN. I'd imagine that the tools available today are much more sophisticated and can probably spread across devices by itself, in this case you can provide an answer with this alternative scenario described.
The scenario should be realistically simulated which means that there are some security measures put in place, like there are in most homes today. In this case, the scenario described that the attacker was already inside and had successfully infected a device, which means that the security measures were penetrated.
The infected device is turned off and the power input is active. Can the infected device still function as an access-point from the outside of the LAN?
If so, what measures are needed to completely cut off the malicious communication?