After gaining initial access, APT41 executes a custom backdoor, allowing them to control compromised systems remotely. The malware deployment was detected via an anomaly in the execution patterns on a critical server.