Having gained initial access, the attackers execute the Matryoshka RAT on the infected systems, establishing a foothold and enabling further malicious activity. The EDR system detected the execution of a suspicious file associated with the Matryoshka RAT.