The attackers deployed second-stage payloads to enhance their intelligence-gathering capabilities and maintain control over compromised systems. This activity is associated with APT29, known for sophisticated supply chain attacks and spearphishing campaigns.