In the last few years, MacOS backdoors have become a hot topic in the industry. What used to be a rare occurrence in the wild is happening more and more frequently. As this topic grows in popularity the details on post-exploitation of Mac intrusions remain a mystery. This talk aims to fill that gap by showing attendees a full Mac intrusion performed by a hostile adversary. Process visualizations, command lines, and other artifacts will be shared from real world intrusions revealing how they got in, what commands were used to move laterally, and how they manually set up their backdoors while trying to fly under the radar by using anti-forensics techniques. Some Linux attack details will be shared as well due to a lot of tools, techniques, and procedures being cross-platform. This will be the first time these cases have seen the light of day. They haven’t been blogged or talked about anywhere else.