APT17 established persistence on the compromised system by modifying registry keys and setting up backdoors. This allows them to maintain access even after system reboots. Indicators of compromise include registry changes and the presence of backdoor files.