Activity timeline
T1601.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1601.002 Downgrade System Image is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of T1601 Modify System Image. Threadlinqs maps 10 of 3847 tracked threats (0.3%) to it; by severity that is 4 critical, 3 high, 3 medium.
Threats that use T1601.002 most often also use T1068 Exploitation for Privilege Escalation (6 threats), T1005 Data from Local System (5 threats), T1059.004 Unix Shell (5 threats), T1190 Exploit Public-Facing Application (5 threats), T1082 System Information Discovery (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
2 tracked threat actors appear in the threats that use T1601.002; the most frequent are Volt Typhoon - G1017 (2), UAT-8616 (1).
Mitigations
MITRE ATT&CK lists 6 mitigations for T1601.002.
Data sources
Telemetry that can reveal T1601.002, per MITRE ATT&CK.
- File — File Modification
Threat actors using it
Tracked threats
10 tracked threats use T1601.002.
- GreyNoise: Attack Surges Against Network Infrastructure Vendors Precede CVE Disclosure by a Median of 11…medium
- Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) Exploited by UAT-8616 and Tied to Volt…critical
- Volt Typhoon 'Silent Train' Relay Framework Used to Conceal Zero-Day Exploitation (CVE-2026-16812…critical
- Tesla Wall Connector Gen 3: Anti-Downgrade (Security Ratchet) Bypass via Charge Port Connectorhigh
- CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Daymedium
- EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver…high
- usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple A12/A12X/A12Z/A13 and S4/S5 Chips Bypassing Secure…critical
- Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM ESP-in-TCP Page-Cache Corruptionhigh
- Residential Proxy Rotation Networks Defeat IP-Reputation-Based Defensesmedium
- CVE-2026-20127 Cisco Catalyst SD-WAN Zero-Day — UAT-8616 Authentication Bypass Active Exploitationcritical
Detection coverage
Threadlinqs maintains 14 detection rules mapped to T1601.002 (SPL 6, KQL 4, Sigma 4). Rule content unlocks with TL Creds on a free account; this page shows counts only.
Parent technique
T1601 Modify System Image — 34 tracked threats at the technique level.