This blog discusses a web shell intrusion incident where attackers abused the IIS worker to exfiltrate stolen data.