### Report: Persistence Mechanism Established

**Summary:**
The attackers succeeded in installing backdoors on several compromised systems, ensuring persistent access even after system reboots or network changes.

**Technical Details:**
- **Backdoor Types:** Custom-built remote access tools (RATs) and modified legitimate software.
- **Installation Methods:**
  - Scheduled tasks.
  - Registry modifications.
  - Service creation.
- **IOCs:**
  - Network traffic patterns indicative of RAT communication.
  - Unusual registry keys and scheduled tasks.

**Recommendations:**
- Conduct thorough system audits and backdoor hunting.
- Reinforce network segmentation to limit lateral movement.

The upcoming report will delve into the lateral movement activities, detailing how attackers progressed to multiple ministries through credential theft.