The threat actors associated with the Sandworm group have successfully installed backdoors on multiple systems within the network. This action is part of their persistence strategy to maintain access even if initial access vectors are mitigated. The logs indicate suspicious activity from an external IP address linked with known malicious activity.