Activity timeline
T1552.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 7 reports, and 11 of the 11 threats were reported in the twelve months to 2026-08.
How adversaries use it
T1552.002 Credentials in Registry is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of T1552 Unsecured Credentials. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 2 critical, 9 high.
Threats that use T1552.002 most often also use T1005 Data from Local System (9 threats), T1068 Exploitation for Privilege Escalation (6 threats), T1071.001 Web Protocols (6 threats), T1112 Modify Registry (6 threats), T1012 Query Registry (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
10 tracked threat actors appear in the threats that use T1552.002; the most frequent are APT38 (1), Andariel (1), Gamaredon (1), JADEPUFFER (1), Lazarus Group (1).
Mitigations
MITRE ATT&CK lists 3 mitigations for T1552.002.
Data sources
Telemetry that can reveal T1552.002, per MITRE ATT&CK.
- Command — Command Execution
- Process — Process Creation
- Windows Registry — Windows Registry Key Access
Threat actors using it
Tracked threats
11 tracked threats use T1552.002.
- Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated JScript Evades Detection in BEC Campaign Targeting…high
- Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…critical
- Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquattinghigh
- LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of…high
- LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public…high
- LegacyHive: Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day PoC (Unpatched, No CVE)high
- LegacyHive: Windows 0-Day Allows Standard Users to Load Another User's Registry Hive via User Profile Servicehigh
- jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)high
- Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now…high
- JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating Database Extortion via Langflow RCE (CVE-2025-3248)…critical
- SEO Poisoning Campaign Impersonates Gemini CLI and Claude Code to Deliver In-Memory PowerShell Infostealer…high
Detection coverage
Threadlinqs maintains 20 detection rules mapped to T1552.002 (SPL 9, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1552 Unsecured Credentials — 551 tracked threats at the technique level.