We then honed in on the network traffic surrounding the CMS managing shipping routes, we discovered that a malicious web shell had been uploaded onto the server.