The attacker is using a malicious scheduled task to connect back to a C2 server.
Tag: Pygmy Goat
Pygmy goat Backdoor
Pygmy Goat uses the LD_PRELOAD environment variable to inject itself into the sshd process, ensuring it’s loaded and executed whenever the SSH daemon starts.