The attackers deploy persistence mechanisms by modifying registry entries, ensuring the Elise backdoor remains active even after system reboots. This step highlights the group's tactics in maintaining a foothold within the network.