### Overview
Following the initial access achieved through VPN authentication bypass, our systems have detected the deployment of web shells on compromised servers.

### Detailed Findings
- **Location:** The web shells were deployed on servers linked to defense contractors.
- **Technique:** The attackers utilized known vulnerabilities in web applications to upload malicious scripts.
- **Indicator of Compromise (IoC):** Unusual POST requests to `/uploads/aspnet_client/system_web/`.

### Recommended Actions
- **Containment:** Immediately isolate affected servers to prevent further exploitation.
- **Mitigation:** Implement application whitelisting to block unauthorized scripts.

### Next Steps
Prepare for potential persistence mechanisms as Hafnium may attempt to maintain access through these web shells.