## Overview
Investigation into the persistence mechanisms used by the attackers revealed sophisticated strategies aimed at maintaining long-term access to critical systems.

## Key Findings
- **Backdoor Implementation**: Custom backdoors were installed on several servers, providing remote access even after reboots.
- **Credential Dumping**: Tools were used to extract credentials, enabling the attackers to create new accounts with elevated privileges.
- **Scheduled Tasks**: Persistent scripts were scheduled to run at regular intervals, ensuring continued access and data collection.

## Next Steps
Immediate actions include dismantling the persistence mechanisms and revising user access policies. Focus is now shifting towards identifying lateral movement attempts that may have compromised additional systems.