The attackers set up persistence mechanisms using scheduled tasks and registry modifications, ensuring continuous access even after system reboots. Network traffic analysis revealed communication with a known malicious IP and the presence of a suspicious scheduled task and registry modification.