APT40 installed a web shell on the compromised server to ensure persistent access, even if initial access vectors are closed. The web shell was identified through unusual POST requests and the presence of a suspicious file on the server.