The attackers have implemented persistence mechanisms, such as scheduled tasks and registry modifications, to ensure they can regain access even if initial efforts are disrupted. A suspicious scheduled task and registry key modification were detected on the host machine. This activity aligns with known APT41 tactics.