### Establishing Persistence with Registry Modifications

To ensure long-term access to compromised systems, the attackers employed registry modifications as a persistence mechanism. By altering registry keys, the RATs were configured to execute upon system startup, ensuring continued control even after system reboots. This method of persistence is indicative of the attackers' intent to maintain an enduring presence in the target environment, allowing for ongoing intelligence gathering and potential future operations.