APT1 demonstrated advanced persistence techniques by adapting their RAT to remain active and undetected during the transition of network control to Marriott. Network traffic analysis detected unexpected outbound connections to a known malicious IP, indicating a potential RAT communication attempt.