The attackers modify system registry settings to establish a persistent presence, allowing them to maintain access even after system reboots. A particular registry key associated with system startup was altered to include a malicious executable linked to known APT activity.