Eviant logo
Threat Research·Analysis·Containment·Eradication

TRACE: Eviant's elite threat research and incident response team

Eviant's elite threat research and incident response team.

We track the adversaries targeting Australian organisations, take their tooling apart and publish what we find. When they get in, we are the team that follows them out.

Read the research ↓ Under attack? security@eviant.com.au
cloudtrail.json TR-01
{
"eventTime": "2025-12-23T14:23:41Z",
"eventSource": "sts.amazonaws.com",
"eventName": "GetCallerIdentity",
"userIdentity": { "type": "IAMUser" },
"sourceIPAddress": "185[.]220[.]101[.]47",
"userAgent": "aws-cli/2.13.5 Python/3.11.4"
}
// first call with the stolen key: who am I?
AWS Lambda backdoor Read →
SolarWinds.Orion.Core.BusinessLayer.dll TR-02
OrionImprovementBusinessLayer
├── Initialize() // entry point
├── Update() // main loop
├── GetHash() // FNV-1a anti-analysis
├── DelayMs() // 12–14 day dormancy
├── GetOrCreateUserID() // fingerprint
└── HttpHelper // C2
SUNBURST teardown Read →
class-wp-rest-server.php TR-03
foreach ( $requests as $single_request ) {
if ( is_wp_error( $single_request ) ) {
$validation[] = $single_request;
continue; // ...but NOT in $matches
}
$match = $this->match_request_to_handler(
$single_request );
$matches[] = $match;
}
wp2shell · CVE-2026-63030 Read →
amos-hunt.md TR-04
# AMOS / ClickLock process-creation hunts
hdiutil attach -nobrowse
xattr -d com.apple.quarantine
osascript display dialog … hidden answer
dscl -authonly # from a non-system process
security … Chrome Safe Storage
ClickFix on macOS Read →
acquire.sh TR-05
aws ssm send-command \
--instance-ids "i-0abc123def456789" \
--document-name "AWS-RunShellScript" \
--parameters 'commands=[
"/tmp/avml --compress /tmp/memory.lime",
"aws s3 cp /tmp/memory.lime s3://forensics…"
]'
EC2 memory forensics Read →
triage.ps1 TR-06
# full compromise sweep
thor64.exe --alldrives --intense
# mounted forensic image
thor64.exe --lab -p E:\mounted-image\
# custom YARA against a suspect path
python3 loki.py --custom-yara ./rules/
DFIR field kit Read →
Latest ClickFix on macOS: How Apple Users Are Being Scammed 18 Sept 2026
Featured research
Incident Response

ClickFix on macOS: How Apple Users Are Being Scammed

ClickFix has become the dominant way macOS infostealers get in the door in 2026. A technical look at how AMOS and ClickLock operate, why Apple's Terminal paste prompt was bypassed within weeks, and what detection coverage actually looks like.

· 5 min read Read →
Close-up of source code on a screen, representing the open-source software supply chain compromised by TeamPCP
Threat Intelligence

TeamPCP: Two WA Men Charged Over Global Open-Source Supply Chain Attack
Illustration of a help desk phone call being used as a social engineering attack vector
Incident Response

No System Is Risk Free: Why Big Companies Keep Falling for the Same Phone Call
Focus areas

What we hunt

Initial access & infostealers

IA

How attackers get the first foothold: paste-and-run lures, fake CAPTCHAs, help desk vishing and the stealers that walk past MFA with session cookies.

Cloud intrusion & forensics

CL

Investigating attackers inside AWS: serverless persistence, volatile memory capture, quiet S3 exfiltration and domain credentials lifted from snapshots.

Supply chain

SC

Compromise that arrives signed and trusted, from SUNBURST's build-pipeline implant to TeamPCP's open-source poisoning.

Vulnerability analysis

VA

Root-cause analysis of critical flaws rebuilt from the patch, with safe detection and the response steps that matter after exploitation.

DFIR tradecraft

DF

The tooling and methods we use on live incidents, and the legitimate admin tools attackers turn into backdoors.

20 published pieces

Follow the threat. Contain the damage. Eradicate the risk.

Browse the full index ↓
Research index

Every TRACE publication

Date Category Title Read
Incident Response ClickFix on macOS: How Apple Users Are Being Scammed 5 min read
Threat Intelligence TeamPCP: Two WA Men Charged Over Global Open-Source Supply Chain Attack 3 min read
Incident Response No System Is Risk Free: Why Big Companies Keep Falling for the Same Phone Call 4 min read
Application Security wp2shell: Inside the WordPress Core Pre-Auth RCE (CVE-2026-63030) and How to Respond 7 min read
Threat Intelligence Open Source Is Broken by Design: How Trust Became the Biggest Vulnerability in Software 6 min read
Cloud Security Vibe Coding: The Invisible Threat Exposing Your Business Data 5 min
Incident Response Cloud Memory Forensics: Acquiring and Analysing Volatile Evidence from AWS EC2 Instances 11 min read
Incident Response DFIR Hunting Tools: THOR, Loki, Chainsaw: The Open-Source Arsenal That Finds What EDR Misses 10 min read
Incident Response TeamViewer: Your Essential IT Tool Is Attackers' Favorite Backdoor 6 min read
Application Security Browser Extensions: The Hidden Security Risk Stealing Your Credentials 5 min read
Incident Response Threat Hunting for Australian Businesses: Beyond Reactive Security 5 min read
Incident Response ClickFix Attacks: The Social Engineering Trick Leading to Credential Theft 5 min read
Application Security GraphQL Security: Preventing Data Exposure and IDOR 4 min read
Incident Response Infostealer Malware: How Credential Theft Bypasses MFA and What to Do About It 9 min read
Cloud Security AWS S3 Data Exfiltration: Detection Beyond CloudTrail Logs 8 min read
Incident Response OpenClaw: Why You Should Avoid These AI Agents 4 min read
Cloud Security Protecting AWS Cloud Snapshots: The Hidden Risk of Stolen Active Directory Credentials 10 min read
Incident Response My Email Was Hacked: Phishing Response for Microsoft 365 3 min read
Incident Response AWS Lambda Backdoor Investigation: Compromised Credentials, EventBridge Persistence, and the Serverless Logging Gap 15 min read
Technical Analysis Inside the SolarWinds SUNBURST Backdoor: A Technical Breakdown of the Most Creative Malware Ever Built 8 min read
The team

Responders who research. Researchers who respond.

TRACE is Eviant's specialist team, based in Australia. Its members have responded to breaches everywhere from small businesses facing their first incident to Fortune 500 companies, financial services, healthcare and government, and they bring that front-line view to every piece of research they publish.

Name
Threat Research, Analysis, Containment and Eradication
Part of
Eviant
Contact
security@eviant.com.au

  • Practitioners first

    The people who write the research are the people who work the incidents. Nothing here is theory.

  • Research feeds response

    Every engagement sharpens the next hunt, and every hunt sharpens the next response.

  • Tested before recommended

    We only recommend what we have implemented and tested ourselves.

  • Show the evidence

    Logs, code and process trees, not adjectives. Defenders should be able to check our work.

All Eviant resources → Active incident? security@eviant.com.au