## Overview
To maintain a foothold within the compromised network, Black Basta employs registry modifications as a persistence mechanism. This ensures that malware can survive system reboots and remain active.

## Key Indicators
- **Registry Changes**: Entries created or modified in `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`.
- **Scheduled Tasks**: New tasks that trigger the execution of QBot.

## Next Steps
With persistence established, lateral movement becomes the next objective for threat actors. Monitoring inter-system communication and user account activities is critical to detect and prevent lateral movement.