# T1552.002 Credentials in Registry > As of 2026-10-05, T1552.002 (Credentials in Registry) appears in 11 tracked threats, first reported 2026-05-21 and most recently 2026-08-22, with linked actors including APT38, Andariel, Gamaredon; it most often appears alongside T1005 (Data from Local System). - **Tracked threats:** 11 (2 critical, 9 high) - **First seen:** 2026-05-21 - **Last seen:** 2026-08-22 - **Threat actors:** 10 - **Detection rules:** 20 (counts only; Blue tier and above) ## Key facts - **ID:** T1552.002 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Parent:** T1552 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1552/002/ ## Activity timeline T1552.002 first appeared in tracked threats on 2026-05-21 and was most recently reported on 2026-08-22. The busiest month was 2026-07 with 7 reports, and 11 of the 11 threats were reported in the twelve months to 2026-08. ## How adversaries use it T1552.002 Credentials in Registry is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552). Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 2 critical, 9 high. Threats that use T1552.002 most often also use [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (9 threats), [T1068 Exploitation for Privilege Escalation](https://intel.threadlinqs.com/technique/T1068) (6 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (6 threats), [T1112 Modify Registry](https://intel.threadlinqs.com/technique/T1112) (6 threats), [T1012 Query Registry](https://intel.threadlinqs.com/technique/T1012) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 10 tracked threat actors appear in the threats that use T1552.002; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (1), [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) (1), [JADEPUFFER](https://intel.threadlinqs.com/actor/JADEPUFFER) (1), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (1). ## Mitigations MITRE ATT&CK lists 3 mitigations for T1552.002. - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) ## Data sources Telemetry that can reveal T1552.002, per MITRE ATT&CK. - Command — Command Execution - Process — Process Creation - Windows Registry — Windows Registry Key Access ## Threat actors using it - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 - [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) — 1 - [JADEPUFFER](https://intel.threadlinqs.com/actor/JADEPUFFER) — 1 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1 - [Nightmare Eclipse](https://intel.threadlinqs.com/actor/Nightmare%20Eclipse) — 1 - [Nightmare-Eclipse](https://intel.threadlinqs.com/actor/Nightmare-Eclipse) — 1 - [NightmareEclipse](https://intel.threadlinqs.com/actor/NightmareEclipse) — 1 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 1 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 1 ## Tracked threats 11 tracked threats use T1552.002. - [Agent Tesla v4 Hidden Behind Unicode-Emoji-Obfuscated JScript Evades Detection in BEC Campaign Targeting…](https://intel.threadlinqs.com/threat/TL-2026-2108) — high — 2026-08-22 - [Microsoft August 2026 Patch Tuesday: 400 Flaws Fixed, Including Lazarus-Exploited Zero-Day CVE-2026-68820…](https://intel.threadlinqs.com/threat/TL-2026-1987) — critical — 2026-08-11 - [Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquatting](https://intel.threadlinqs.com/threat/TL-2026-1845) — high — 2026-08-03 - [LegacyHive: Public PoC for Unpatched Windows User Profile Service (ProfSvc) Arbitrary Hive Load Elevation of…](https://intel.threadlinqs.com/threat/TL-2026-1502) — high — 2026-07-18 - [LegacyHive: Unpatched Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day — Public…](https://intel.threadlinqs.com/threat/TL-2026-1445) — high — 2026-07-17 - [LegacyHive: Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day PoC (Unpatched, No CVE)](https://intel.threadlinqs.com/threat/TL-2026-1414) — high — 2026-07-16 - [LegacyHive: Windows 0-Day Allows Standard Users to Load Another User's Registry Hive via User Profile Service](https://intel.threadlinqs.com/threat/TL-2026-1351) — high — 2026-07-15 - [jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)](https://intel.threadlinqs.com/threat/TL-2026-1233) — high — 2026-07-11 - [Gamaredon (Primitive Bear / Shuckworm) APT Profile: Russia-Aligned Espionage Against Ukraine and NATO, Now…](https://intel.threadlinqs.com/threat/TL-2026-1210) — high — 2026-07-11 - [JADEPUFFER: Agentic (LLM-Driven) Ransomware Automating Database Extortion via Langflow RCE (CVE-2025-3248)…](https://intel.threadlinqs.com/threat/TL-2026-1044) — critical — 2026-07-01 - [SEO Poisoning Campaign Impersonates Gemini CLI and Claude Code to Deliver In-Memory PowerShell Infostealer…](https://intel.threadlinqs.com/threat/TL-2026-0546) — high — 2026-05-21 ## Related CVEs CVEs referenced by the tracked threats that use T1552.002, most frequent first. - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2026-55040](https://intel.threadlinqs.com/cve/CVE-2026-55040) - [CVE-2026-68820](https://intel.threadlinqs.com/cve/CVE-2026-68820) ## Detection coverage Threadlinqs maintains 20 detection rules mapped to T1552.002 (SPL 9, KQL 5, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only. 20 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1552 Unsecured Credentials](https://intel.threadlinqs.com/technique/T1552) — 551 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1552.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)