During network traffic analysis, an unauthorized communication from an internal host to a known malicious IP was detected. This activity correlates with the installation of a backdoor by the Sandworm threat actor to maintain prolonged access.