# T1542.001 System Firmware > As of 2026-10-28, T1542.001 (System Firmware) appears in 10 tracked threats, first reported 2026-06-18 and most recently 2026-10-27, with linked actors including NightmareEclipse; it most often appears alongside T1685 (Disable or Modify Tools). - **Tracked threats:** 10 (3 critical, 5 high, 2 medium) - **First seen:** 2026-06-18 - **Last seen:** 2026-10-27 - **Threat actors:** 1 - **Detection rules:** 38 (counts only; Blue tier and above) ## Key facts - **ID:** T1542.001 - **Framework:** MITRE ATT&CK - **Tactics:** Persistence, Stealth (formerly Defense Evasion) - **Matrix:** Enterprise - **Parent:** T1542 - **Data as of:** 2026-10-28 - **MITRE:** https://attack.mitre.org/techniques/T1542/001/ ## Activity timeline T1542.001 first appeared in tracked threats on 2026-06-18 and was most recently reported on 2026-10-27. The busiest month was 2026-07 with 4 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1542.001 System Firmware is catalogued by MITRE ATT&CK under the Persistence and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of [T1542 Pre-OS Boot](https://intel.threadlinqs.com/technique/T1542). Threadlinqs maps 10 of 3287 tracked threats (0.3%) to it; by severity that is 3 critical, 5 high, 2 medium. Threats that use T1542.001 most often also use [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (8 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (7 threats), [T1495 Firmware Corruption](https://intel.threadlinqs.com/technique/T1495) (6 threats), [T1068 Exploitation for Privilege Escalation](https://intel.threadlinqs.com/technique/T1068) (5 threats), [T1211 Exploitation for Stealth](https://intel.threadlinqs.com/technique/T1211) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 1 tracked threat actor appear in the threats that use T1542.001; the most frequent are [NightmareEclipse](https://intel.threadlinqs.com/actor/NightmareEclipse) (1). ## Mitigations MITRE ATT&CK lists 3 mitigations for T1542.001. - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1046 Boot Integrity](https://attack.mitre.org/mitigations/M1046/) - [M1051 Update Software](https://attack.mitre.org/mitigations/M1051/) ## Data sources Telemetry that can reveal T1542.001, per MITRE ATT&CK. - Firmware — Firmware Modification ## Threat actors using it - [NightmareEclipse](https://intel.threadlinqs.com/actor/NightmareEclipse) — 1 ## Tracked threats 10 tracked threats use T1542.001. - [CVE-2026-97631: Code-Execution Flaw in TianoCore EDK II UEFI Firmware (PXE ICMP Error Handlers) Affects Most…](https://intel.threadlinqs.com/threat/TL-2026-4579) — critical — 2026-10-27 - [Tesla Wall Connector Gen 3: Anti-Downgrade (Security Ratchet) Bypass via Charge Port Connector](https://intel.threadlinqs.com/threat/TL-2026-2425) — high — 2026-09-09 - ["Download More RAM" Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing (CVE-2026-23670)](https://intel.threadlinqs.com/threat/TL-2026-2039) — medium — 2026-08-17 - [NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825…](https://intel.threadlinqs.com/threat/TL-2026-1865) — critical — 2026-08-04 - [CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Day](https://intel.threadlinqs.com/threat/TL-2026-1346) — medium — 2026-07-15 - [11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797)](https://intel.threadlinqs.com/threat/TL-2026-1340) — high — 2026-07-14 - [Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797)](https://intel.threadlinqs.com/threat/TL-2026-1298) — high — 2026-07-14 - [Dell BIOS Flaw (CVE-2026-40639 / DSA-2026-197) Lets Attackers Recover Admin Passwords From SPI Flash](https://intel.threadlinqs.com/threat/TL-2026-1200) — high — 2026-07-11 - [usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple A12/A12X/A12Z/A13 and S4/S5 Chips Bypassing Secure…](https://intel.threadlinqs.com/threat/TL-2026-0860) — critical — 2026-06-18 - [Airoha Bluetooth SoC Authentication Bypass & RACE Protocol Abuse (CVE-2025-20700/20701/20702) Enables…](https://intel.threadlinqs.com/threat/TL-2026-0850) — high — 2026-06-18 ## Related CVEs CVEs referenced by the tracked threats that use T1542.001, most frequent first. - [CVE-2015-5281](https://intel.threadlinqs.com/cve/CVE-2015-5281) - [CVE-2026-45585](https://intel.threadlinqs.com/cve/CVE-2026-45585) - [CVE-2026-8863](https://intel.threadlinqs.com/cve/CVE-2026-8863) - [CVE-2019-8900](https://intel.threadlinqs.com/cve/CVE-2019-8900) - [CVE-2020-17103](https://intel.threadlinqs.com/cve/CVE-2020-17103) - [CVE-2023-21563](https://intel.threadlinqs.com/cve/CVE-2023-21563) - [CVE-2025-20700](https://intel.threadlinqs.com/cve/CVE-2025-20700) - [CVE-2025-20701](https://intel.threadlinqs.com/cve/CVE-2025-20701) - [CVE-2025-20702](https://intel.threadlinqs.com/cve/CVE-2025-20702) - [CVE-2025-8321](https://intel.threadlinqs.com/cve/CVE-2025-8321) - [CVE-2026-23670](https://intel.threadlinqs.com/cve/CVE-2026-23670) - [CVE-2026-33825](https://intel.threadlinqs.com/cve/CVE-2026-33825) - [CVE-2026-40639](https://intel.threadlinqs.com/cve/CVE-2026-40639) - [CVE-2026-41091](https://intel.threadlinqs.com/cve/CVE-2026-41091) - [CVE-2026-45498](https://intel.threadlinqs.com/cve/CVE-2026-45498) - [CVE-2026-45586](https://intel.threadlinqs.com/cve/CVE-2026-45586) - [CVE-2026-50507](https://intel.threadlinqs.com/cve/CVE-2026-50507) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) ## Detection coverage Threadlinqs maintains 38 detection rules mapped to T1542.001 (SPL 15, KQL 8, Sigma 15). Rule content is available to Blue tier accounts and above; this page shows counts only. 38 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1542 Pre-OS Boot](https://intel.threadlinqs.com/technique/T1542) — 25 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1542.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)