### Overview
APT1 has implemented sophisticated persistence mechanisms to maintain control over Marriott's network, even post-acquisition.

### Key Findings
- **Registry Modifications**: Alterations in system registries ensure the RAT reinitializes upon system reboot.
- **Scheduled Tasks**: New tasks have been created to periodically execute the RAT, ensuring continued presence.
- **Credential Dumping**: Harvested credentials are used to re-establish access if initial footholds are compromised.

### Next Steps
APT1's strategy will likely involve lateral movement, exploiting network trust to expand their infiltration scope.