How does PoisonFrog achieve persistence on the victim machine?

PoisonFrog creates two scheduled tasks named `\UpdateTasks\UpdateTask` and `\UpdateTasks\UpdateTaskHosts`, both running every 10 minutes. These tasks execute `UpdateTask.vbs`, which loads two PowerShell scripts (`dUpdater.ps1` and `hUpdater.ps1`) with current user and System permissions, as detailed in the [Analysis of APT34 Leaked Tools - PoisonFrog and Glimpse](/news/analysis-of-apt34-leaked-tools-poisonfrog-and-glimpse) article.