To solidify their presence, Groundbait modifies registry settings on affected machines, ensuring the malware runs on startup and persists through reboots. The attacker has modified the registry to include the malware executable in the startup sequence.