A Turla Javascript backdoor added a local_update_check value under the Registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.