The attackers establish persistence on the compromised machines by creating a scheduled task that ensures HyperBro reloads even after system reboots. The task is configured to run at system start, executing a malicious script associated with the HyperBro RAT.