APT38 has been detected establishing persistent access within the bank's infrastructure by creating backdoors. The operation involves setting up scheduled tasks and modifying startup scripts to maintain control over the compromised systems.