The campaigns maintain persistence on machines by creating two daily scheduled task entries. The code, meanwhile, is still controlled by the FIN7 actors and may be leveraged in future attacks by the group