### Context
The attackers established persistence within the NHS network by utilizing scheduled tasks and other methods to ensure the ransomware could survive system reboots.

### Insight
By creating scheduled tasks, the ransomware was able to reinitiate itself, complicating remediation efforts and prolonging the disruption.

### Next Steps
Efforts should focus on detecting lateral movement attempts as the attackers seek to propagate the ransomware across the network.