Analysis of an incident involving a web shell used as a backdoor