Following initial access, Hafnium deploys the China Chopper web shell to maintain persistent access and command capabilities on the compromised server. The web shell allows remote control and execution of commands on the server.