APT35 is leveraging legitimate cloud services to establish command and control channels, maintaining persistent access to compromised systems. The operation involves using a cloud storage service to host malicious scripts that are periodically executed by the compromised host.