### Summary
APT40 has been observed deploying web shells to maintain persistence within the compromised university network. These web shells provide ongoing access even if the initial breach is discovered and remediated.

### Web Shell Indicators
- **File Names and Locations**: Web shells are hidden within legitimate directories under misleading names.
- **Command and Control**: Use of HTTP/S protocols to communicate with external servers.

### Countermeasures
- **File Integrity Monitoring**: Deploy monitoring solutions to detect unauthorized file changes or additions.
- **Network Traffic Analysis**: Watch for anomalous outbound traffic indicative of data staging or exfiltration.