The attackers have used BlackEnergy malware to establish persistence on the target system. This was achieved through registry modifications and the creation of scheduled tasks, which were detected as anomalies in system configurations by the EDR.