The attackers deployed a custom Remote Access Trojan (RAT) named 'RATDeploy.exe' on the compromised system. This malware allows the attacker to execute commands remotely and maintain persistent access.