In the end, the plan was simple.
Professor Lup-Remus, overheard Greyback bragging, name dropping Malfoy Manor. Theo knew the layout and Sirius had a fireplace in Grimmauld that would give them floo access.
The obstacles were the wards and the army.
Tonks introduced them to a cursebreaker, then it was just a matter of waiting for the next Death Eater revel to clear out the Manor.
When the day came, the eldest Weasley made quick work of the Malfoy wards.
Theo was back in moments, his Hufflepuff theld tight in his arms. And there she'd stayed 'til morning.