Network traffic analysis has identified persistent communication between internal hosts and known APT41 command and control servers. The backdoors on compromised systems maintain communication to ensure ongoing control. Indicators such as IPs, hashes, and domains have been flagged.