APT29 has been observed abusing OAuth tokens to escalate privileges within the cloud infrastructure. This activity was detected following an initial access, indicating potential persistence strategies by the threat actor.