Sandworm group has installed backdoors on compromised systems to maintain persistent access. This operation is aimed at re-establishing access points that allow for re-entry, complicating recovery and mitigation efforts.