Known Exploited Threat intelligence on the actors exploiting edge devices, Linux and ESXi. By Thomas Andreatta.

About

I'm a cyber threat intelligence analyst and former security and infrastructure engineer. Known Exploited is where I track the groups exploiting edge devices, Linux and ESXi, and publish what I find.

I've been hacking since 2019 — breaking into systems, studying low-level internals, and writing kernel code. I've worked as a SOC analyst on the blue team and a pentester on the red team, with clients including banks, healthcare systems, and other national-scale enterprises. I later moved to KLM, first as a cyber security engineer and now as a cyber threat intelligence analyst, tracking threats to aviation, emerging attacks, and APTs.
I'm drawn to this work by the same thing that drew me to security: curiosity about surveillance and attacks patient enough to stay hidden. Andy Greenberg's Sandworm is the book that got me hooked on nation-state operations — the way they reshape the world while staying almost invisible. That's what I want to write about here: not just vulnerabilities, but the campaigns behind them.

What I cover

  • Espionage and criminal groups exploiting edge devices (VPN gateways, firewalls, load balancers), Linux servers and ESXi, with a focus on activity that reaches Europe.
  • The infrastructure behind them: how it's set up, how to find it, and when it changes. The actor library re-checks it every day.
  • Detection: rules and hunting queries tested against real samples and logs, with the test evidence published alongside.

How I work

I go to the primary evidence (the sample, the server, the advisory itself) rather than to somebody else's summary of it. Every profile lists its sources and states how confident the assessment is. Infrastructure indicators carry an expiry date, because servers change hands. I'd rather publish an honest uncertainty than an attribution that outruns the evidence.

Corrections

If something here is wrong, including published infrastructure (an address that turns out to belong to someone else), tell me and I'll fix it. Infrastructure corrections are handled first. Substantive corrections are noted on the piece itself with the date and what changed, not silently edited away. Reach me at the addresses on the contact page.

Conflicts of interest

I work as a cyber threat intelligence analyst at KLM. To keep this space independent, I don't write about KLM, its customers, its vendors, or anything I've learned through that work. Everything published or sold here comes from public sources and my own collection; no data, samples or reports from my employer.

Funding

Known Exploited is a small independent business. The actor library and feeds (see plans) pay for the free work published here. Nothing is sponsored, and no vendor pays for coverage.