Activity timeline
T1584.008 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 11 of the 11 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1584.008 Network Devices is catalogued by MITRE ATT&CK under the Resource Development tactic in the Enterprise matrix, as a sub-technique of T1584 Compromise Infrastructure. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 2 critical, 8 high, 1 medium.
Threats that use T1584.008 most often also use T1027 Obfuscated Files or Information (6 threats), T1190 Exploit Public-Facing Application (6 threats), T1071 Application Layer Protocol (4 threats), T1071.001 Web Protocols (4 threats), T1082 System Information Discovery (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
9 tracked threat actors appear in the threats that use T1584.008; the most frequent are APT28 (1), BlueDelta (1), Cyber Av3ngers (1), Forest Blizzard (1), Midnight Blizzard (1).
Threat actors using it
Tracked threats
11 tracked threats use T1584.008.
- BPFDoor, Rekoobe and AVERAT Linux Implants Impersonate SpamSniper and ShareTech Mail Security Appliances…high
- Nation-State Intrusions into Telecom Infrastructure via SS7, BGP Hijacking, and Router Compromise (Salt…high
- FBI, DOJ, and RCMP Seize NightmareStresser DDoS-for-Hire Domains in Latest Operation PowerOFF Actionmedium
- BambooToken Malware Uses MQTT Protocol for Cross-Platform Windows/Linux C2high
- CVE-2026-20212: Critical Unauthenticated RCE in Cisco Nexus 9000 Series Switches (Silicon One ASIC)critical
- Rapid7 Q2 2026 Threat Landscape Report: Vulnerability Disclosures Double, AI-Assisted Exploitation…high
- CaptiveCrunch: Midnight Blizzard (Storm-2945) Hospitality Captive-Portal AiTM Campaignhigh
- FSB Centre 16 (Berserk Bear/Energetic Bear) targets global critical national infrastructure via vulnerable…high
- UAT-7810 Expands ORB Networks with LONGLEASH, DOGLEASH, and JARLEASH Malware Suite (CVE-2020-22653…high
- CVE-2026-11405: Undocumented Authentication Backdoor in Tenda Router Firmware (FH1201, W15E, AC10, AC5, AC6)critical
- UNC6508 (PRC-Nexus) Trojanizes Unpatched REDCap Research Servers with INFINITERED Malware to Spy on North…high
Detection coverage
Threadlinqs maintains 21 detection rules mapped to T1584.008 (SPL 7, KQL 7, Sigma 7). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1584 Compromise Infrastructure — 164 tracked threats at the technique level.