# T1601.002 Downgrade System Image > As of 2026-11-12, T1601.002 (Downgrade System Image) appears in 10 tracked threats, first reported 2026-03-02 and most recently 2026-10-30, with linked actors including Volt Typhoon - G1017, UAT-8616; it most often appears alongside T1068 (Exploitation for Privilege Escalation). - **Tracked threats:** 10 (4 critical, 3 high, 3 medium) - **First seen:** 2026-03-02 - **Last seen:** 2026-10-30 - **Threat actors:** 2 - **Detection rules:** 14 (counts only; unlock with TL Creds) ## Key facts - **ID:** T1601.002 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Impairment - **Matrix:** Enterprise - **Parent:** T1601 - **Data as of:** 2026-11-12 - **MITRE:** https://attack.mitre.org/techniques/T1601/002/ ## Activity timeline T1601.002 first appeared in tracked threats on 2026-03-02 and was most recently reported on 2026-10-30. The busiest month was 2026-10 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1601.002 Downgrade System Image is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of [T1601 Modify System Image](https://intel.threadlinqs.com/technique/T1601). Threadlinqs maps 10 of 3847 tracked threats (0.3%) to it; by severity that is 4 critical, 3 high, 3 medium. Threats that use T1601.002 most often also use [T1068 Exploitation for Privilege Escalation](https://intel.threadlinqs.com/technique/T1068) (6 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (5 threats), [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) (5 threats), [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (5 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 2 tracked threat actors appear in the threats that use T1601.002; the most frequent are [Volt Typhoon - G1017](https://intel.threadlinqs.com/actor/Volt%20Typhoon%20-%20G1017) (2), [UAT-8616](https://intel.threadlinqs.com/actor/UAT-8616) (1). ## Mitigations MITRE ATT&CK lists 6 mitigations for T1601.002. - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) - [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/) - [M1032 Multi-factor Authentication](https://attack.mitre.org/mitigations/M1032/) - [M1043 Credential Access Protection](https://attack.mitre.org/mitigations/M1043/) - [M1045 Code Signing](https://attack.mitre.org/mitigations/M1045/) - [M1046 Boot Integrity](https://attack.mitre.org/mitigations/M1046/) ## Data sources Telemetry that can reveal T1601.002, per MITRE ATT&CK. - File — File Modification ## Threat actors using it - [Volt Typhoon - G1017](https://intel.threadlinqs.com/actor/Volt%20Typhoon%20-%20G1017) — 2 - [UAT-8616](https://intel.threadlinqs.com/actor/UAT-8616) — 1 ## Tracked threats 10 tracked threats use T1601.002. - [GreyNoise: Attack Surges Against Network Infrastructure Vendors Precede CVE Disclosure by a Median of 11…](https://intel.threadlinqs.com/threat/TL-2026-4782) — medium — 2026-10-30 - [Cisco Catalyst SD-WAN Authentication Bypass (CVE-2026-20127) Exploited by UAT-8616 and Tied to Volt…](https://intel.threadlinqs.com/threat/TL-2026-4729) — critical — 2026-10-29 - [Volt Typhoon 'Silent Train' Relay Framework Used to Conceal Zero-Day Exploitation (CVE-2026-16812…](https://intel.threadlinqs.com/threat/TL-2026-4665) — critical — 2026-10-28 - [Tesla Wall Connector Gen 3: Anti-Downgrade (Security Ratchet) Bypass via Charge Port Connector](https://intel.threadlinqs.com/threat/TL-2026-2425) — high — 2026-09-09 - [CVE-2026-50661: Windows BitLocker Security Feature Bypass 0-Day](https://intel.threadlinqs.com/threat/TL-2026-1346) — medium — 2026-07-15 - [EtherRAT: DPRK-Linked Vishing Campaign Abuses Microsoft Teams and Ethereum Smart Contracts to Deliver…](https://intel.threadlinqs.com/threat/TL-2026-1191) — high — 2026-07-10 - [usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple A12/A12X/A12Z/A13 and S4/S5 Chips Bypassing Secure…](https://intel.threadlinqs.com/threat/TL-2026-0860) — critical — 2026-06-18 - [Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM ESP-in-TCP Page-Cache Corruption](https://intel.threadlinqs.com/threat/TL-2026-0510) — high — 2026-05-13 - [Residential Proxy Rotation Networks Defeat IP-Reputation-Based Defenses](https://intel.threadlinqs.com/threat/TL-2026-1467) — medium — 2026-04-02 - [CVE-2026-20127 Cisco Catalyst SD-WAN Zero-Day — UAT-8616 Authentication Bypass Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-0166) — critical — 2026-03-02 ## Related CVEs CVEs referenced by the tracked threats that use T1601.002, most frequent first. - [CVE-2022-20775](https://intel.threadlinqs.com/cve/CVE-2022-20775) - [CVE-2026-20127](https://intel.threadlinqs.com/cve/CVE-2026-20127) - [CVE-2025-8875](https://intel.threadlinqs.com/cve/CVE-2025-8875) - [CVE-2025-8876](https://intel.threadlinqs.com/cve/CVE-2025-8876) - [CVE-2026-16812](https://intel.threadlinqs.com/cve/CVE-2026-16812) - [CVE-2019-8900](https://intel.threadlinqs.com/cve/CVE-2019-8900) - [CVE-2023-21563](https://intel.threadlinqs.com/cve/CVE-2023-21563) - [CVE-2024-39717](https://intel.threadlinqs.com/cve/CVE-2024-39717) - [CVE-2025-8321](https://intel.threadlinqs.com/cve/CVE-2025-8321) - [CVE-2026-0400](https://intel.threadlinqs.com/cve/CVE-2026-0400) - [CVE-2026-20122](https://intel.threadlinqs.com/cve/CVE-2026-20122) - [CVE-2026-20128](https://intel.threadlinqs.com/cve/CVE-2026-20128) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2026-45585](https://intel.threadlinqs.com/cve/CVE-2026-45585) - [CVE-2026-50507](https://intel.threadlinqs.com/cve/CVE-2026-50507) - [CVE-2026-50661](https://intel.threadlinqs.com/cve/CVE-2026-50661) ## Detection coverage Threadlinqs maintains 14 detection rules mapped to T1601.002 (SPL 6, KQL 4, Sigma 4). Rule content unlocks with TL Creds on a free account; this page shows counts only. 14 detection rules (SPL/KQL/Sigma), unlock with TL Creds: https://threadlinqs.com/tl-creds ## Parent technique [T1601 Modify System Image](https://intel.threadlinqs.com/technique/T1601) — 34 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1601.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); MCP for AI agents (Purple): https://intel.threadlinqs.com/mcp