A penetration tester discovers a web server that is within the scope of the engagement has already been compromised with a backdoor. Which of the following should the penetration tester do NEXT?

A. Forensically acquire the backdoor Trojan and perform attribution.
B. Utilize the backdoor in support of the engagement.
C. Continue the engagement and include the backdoor finding in the final report.
D. Inform the customer immediately about the backdoor.