Attackers have modified the system registry to establish persistence, ensuring continued access to the compromised network. This change allows them to return even if initial access is detected and blocked.