Activity timeline
T1602.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1602.002 Network Device Configuration Dump is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix, as a sub-technique of T1602 Data from Configuration Repository. Threadlinqs maps 12 of 2774 tracked threats (0.4%) to it; by severity that is 6 critical, 5 high, 1 medium.
Threats that use T1602.002 most often also use T1190 Exploit Public-Facing Application (10 threats), T1098 Account Manipulation (8 threats), T1040 Network Sniffing (7 threats), T1041 Exfiltration Over C2 Channel (7 threats), T1078 Valid Accounts (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
11 tracked threat actors appear in the threats that use T1602.002; the most frequent are Lynx (3), INC Ransom (2), INC Ransom - G1032 (2), APT36 (1), FSB Center 16 (1).
Mitigations
MITRE ATT&CK lists 6 mitigations for T1602.002.
Data sources
Telemetry that can reveal T1602.002, per MITRE ATT&CK.
- Network Traffic — Network Connection Creation, Network Traffic Content
Threat actors using it
Tracked threats
12 tracked threats use T1602.002.
- FortiBleed: Credential-Harvesting Campaign Compromising 86,644+ Fortinet FortiGate Devices and Locking Out…critical
- FortiBleed: Ongoing Credential-Harvesting Campaign Against Fortinet FortiGate Firewalls and SSL VPN Gateways…high
- Nation-State Intrusions into Telecom Infrastructure via SS7, BGP Hijacking, and Router Compromise (Salt…high
- CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCEcritical
- PATCHCORD, SHEETCORD & HACKERAI C2 Agent: New Malware Cluster Targets Afghan Telecom and South Asian…high
- US Treasury Sanctions 1VPNS VPN Service and Cryptor Seller for Enabling Ransomware Operations (linked to FSB…medium
- FSB Centre 16 (Berserk Bear/Energetic Bear) targets global critical national infrastructure via vulnerable…high
- Russian FSB Center 16 (Static Tundra/Berserk Bear) Exploiting Unpatched Cisco Smart Install Devices — Joint…high
- FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…critical
- FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and…critical
- AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55…critical
- Fortinet FortiCloud SSO Cross-Tenant Authentication Bypass (CVE-2026-24858)critical
Detection coverage
Threadlinqs maintains 20 detection rules mapped to T1602.002 (SPL 8, KQL 6, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1602 Data from Configuration Repository — 25 tracked threats at the technique level.