The attackers installed a persistent backdoor on the compromised system to maintain access even if the primary route is detected and blocked. This action was identified through integrity monitoring, indicating manipulation of system files and unauthorized network communication.