The attackers have installed a custom backdoor linked to known Gamaredon toolsets to ensure continued access to the compromised network. The backdoor was executed under the username 'admin_user' on the host 'compromised_host', with the file 'gamaredon_backdoor.exe' identified by the hash 'd41d8cd98f00b204e9800998ecf8427e'. The malicious activity was linked to the external IP address '185.220.101.1'.