Palo Alto network edge device backdoor, Cyberhaven browser extension hack, 2024 research highlights

Security Conversations

Three Buddy Problem - Episode 26: We discuss the discovery of a Palo Alto network firewall attack and a stealthy network edge device backdoor (LITTLELAMB.WOOLTEA), the Cyberhaven hack and the shady world of browser extensions, and a look back at the top research projects that caught our attention in 2025.

Cast: Juan Andres Guerrero-Saade, Costin Raiu and Ryan Naraine.

Links:

• Transcript (unedited, AI-generated)
• LITTLELAMB.WOOLTEA: Stealthy Network Edge Device Backdoor
• Palo Alto: Operation Lunar Peek
• Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts
• “A Digital Prison”: Surveillance and the suppression of civil society in Serbia
• Cyberhaven breach reported. Employee phished and pushed malicious chrome extension
• GRU 29155 doing cyber operations
• How a Group of Israel-Linked Hackers Has Pushed the Limits of Cyberwar
• Sophos Used Custom Implants to Surveil Chinese Hackers Targeting Firewall Zero-Days
• Operation MiddleFloor: Unmasking the Disinformation Campaign Targeting Moldova's National Elections
• NSPX30: A sophisticated AitM-enabled implant evolving since 2005
• backdoor in upstream xz/liblzma leading to ssh server compromise
• PKfail: Untrusted Platform Keys Undermine Secure Boot on UEFI Ecosystem
• The Tech Coup - How to Save Democracy from Silicon Valley