# T1602.002 Network Device Configuration Dump > As of 2026-10-12, T1602.002 (Network Device Configuration Dump) appears in 12 tracked threats, first reported 2026-01-27 and most recently 2026-10-07, with linked actors including Lynx, INC Ransom, INC Ransom - G1032; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 12 (6 critical, 5 high, 1 medium) - **First seen:** 2026-01-27 - **Last seen:** 2026-10-07 - **Threat actors:** 11 - **Detection rules:** 20 (counts only; Blue tier and above) ## Key facts - **ID:** T1602.002 - **Framework:** MITRE ATT&CK - **Tactics:** Collection - **Matrix:** Enterprise - **Parent:** T1602 - **Data as of:** 2026-10-12 - **MITRE:** https://attack.mitre.org/techniques/T1602/002/ ## Activity timeline T1602.002 first appeared in tracked threats on 2026-01-27 and was most recently reported on 2026-10-07. The busiest month was 2026-07 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1602.002 Network Device Configuration Dump is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix, as a sub-technique of [T1602 Data from Configuration Repository](https://intel.threadlinqs.com/technique/T1602). Threadlinqs maps 12 of 2774 tracked threats (0.4%) to it; by severity that is 6 critical, 5 high, 1 medium. Threats that use T1602.002 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (10 threats), [T1098 Account Manipulation](https://intel.threadlinqs.com/technique/T1098) (8 threats), [T1040 Network Sniffing](https://intel.threadlinqs.com/technique/T1040) (7 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (7 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 11 tracked threat actors appear in the threats that use T1602.002; the most frequent are [Lynx](https://intel.threadlinqs.com/actor/Lynx) (3), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) (2), [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) (2), [APT36](https://intel.threadlinqs.com/actor/APT36) (1), [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) (1). ## Mitigations MITRE ATT&CK lists 6 mitigations for T1602.002. - [M1030 Network Segmentation](https://attack.mitre.org/mitigations/M1030/) - [M1031 Network Intrusion Prevention](https://attack.mitre.org/mitigations/M1031/) - [M1037 Filter Network Traffic](https://attack.mitre.org/mitigations/M1037/) - [M1041 Encrypt Sensitive Information](https://attack.mitre.org/mitigations/M1041/) - [M1051 Update Software](https://attack.mitre.org/mitigations/M1051/) - [M1054 Software Configuration](https://attack.mitre.org/mitigations/M1054/) ## Data sources Telemetry that can reveal T1602.002, per MITRE ATT&CK. - Network Traffic — Network Connection Creation, Network Traffic Content ## Threat actors using it - [Lynx](https://intel.threadlinqs.com/actor/Lynx) — 3 - [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom) — 2 - [INC Ransom - G1032](https://intel.threadlinqs.com/actor/INC%20Ransom%20-%20G1032) — 2 - [APT36](https://intel.threadlinqs.com/actor/APT36) — 1 - [FSB Center 16](https://intel.threadlinqs.com/actor/FSB%20Center%2016) — 1 - [FSB Centre 16](https://intel.threadlinqs.com/actor/FSB%20Centre%2016) — 1 - [INC Ransomware](https://intel.threadlinqs.com/actor/INC%20Ransomware) — 1 - [Salt Typhoon - G1045](https://intel.threadlinqs.com/actor/Salt%20Typhoon%20-%20G1045) — 1 - [SantaAd](https://intel.threadlinqs.com/actor/SantaAd) — 1 - [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra) — 1 - [Transparent Tribe](https://intel.threadlinqs.com/actor/Transparent%20Tribe) — 1 ## Tracked threats 12 tracked threats use T1602.002. - [FortiBleed: Credential-Harvesting Campaign Compromising 86,644+ Fortinet FortiGate Devices and Locking Out…](https://intel.threadlinqs.com/threat/TL-2026-3031) — critical — 2026-10-07 - [FortiBleed: Ongoing Credential-Harvesting Campaign Against Fortinet FortiGate Firewalls and SSL VPN Gateways…](https://intel.threadlinqs.com/threat/TL-2026-2989) — high — 2026-10-06 - [Nation-State Intrusions into Telecom Infrastructure via SS7, BGP Hijacking, and Router Compromise (Salt…](https://intel.threadlinqs.com/threat/TL-2026-2649) — high — 2026-09-25 - [CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCE](https://intel.threadlinqs.com/threat/TL-2026-2440) — critical — 2026-09-10 - [PATCHCORD, SHEETCORD & HACKERAI C2 Agent: New Malware Cluster Targets Afghan Telecom and South Asian…](https://intel.threadlinqs.com/threat/TL-2026-2006) — high — 2026-08-13 - [US Treasury Sanctions 1VPNS VPN Service and Cryptor Seller for Enabling Ransomware Operations (linked to FSB…](https://intel.threadlinqs.com/threat/TL-2026-1290) — medium — 2026-07-14 - [FSB Centre 16 (Berserk Bear/Energetic Bear) targets global critical national infrastructure via vulnerable…](https://intel.threadlinqs.com/threat/TL-2026-2375) — high — 2026-07-13 - [Russian FSB Center 16 (Static Tundra/Berserk Bear) Exploiting Unpatched Cisco Smart Install Devices — Joint…](https://intel.threadlinqs.com/threat/TL-2026-1277) — high — 2026-07-13 - [FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…](https://intel.threadlinqs.com/threat/TL-2026-1232) — critical — 2026-07-11 - [FortiBleed: Russian-Speaking Credential-Harvesting Campaign Against Internet-Exposed FortiGate Firewalls and…](https://intel.threadlinqs.com/threat/TL-2026-0895) — critical — 2026-06-21 - [AI-Augmented FortiGate Mass Exploitation — Russian-Speaking Actor Breaches 600+ Firewalls Across 55…](https://intel.threadlinqs.com/threat/TL-2026-0131) — critical — 2026-02-22 - [Fortinet FortiCloud SSO Cross-Tenant Authentication Bypass (CVE-2026-24858)](https://intel.threadlinqs.com/threat/TL-2026-0003) — critical — 2026-01-27 ## Related CVEs CVEs referenced by the tracked threats that use T1602.002, most frequent first. - [CVE-2018-0171](https://intel.threadlinqs.com/cve/CVE-2018-0171) - [CVE-2008-4128](https://intel.threadlinqs.com/cve/CVE-2008-4128) - [CVE-2025-59718](https://intel.threadlinqs.com/cve/CVE-2025-59718) - [CVE-2026-24858](https://intel.threadlinqs.com/cve/CVE-2026-24858) - [CVE-2025-59719](https://intel.threadlinqs.com/cve/CVE-2025-59719) - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2019-7192](https://intel.threadlinqs.com/cve/CVE-2019-7192) - [CVE-2022-40684](https://intel.threadlinqs.com/cve/CVE-2022-40684) - [CVE-2022-41328](https://intel.threadlinqs.com/cve/CVE-2022-41328) - [CVE-2022-42475](https://intel.threadlinqs.com/cve/CVE-2022-42475) - [CVE-2023-20198](https://intel.threadlinqs.com/cve/CVE-2023-20198) - [CVE-2023-20273](https://intel.threadlinqs.com/cve/CVE-2023-20273) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2023-27997](https://intel.threadlinqs.com/cve/CVE-2023-27997) - [CVE-2023-46805](https://intel.threadlinqs.com/cve/CVE-2023-46805) - [CVE-2023-48788](https://intel.threadlinqs.com/cve/CVE-2023-48788) - [CVE-2024-21762](https://intel.threadlinqs.com/cve/CVE-2024-21762) - [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887) - [CVE-2024-23113](https://intel.threadlinqs.com/cve/CVE-2024-23113) - [CVE-2024-3400](https://intel.threadlinqs.com/cve/CVE-2024-3400) - [CVE-2024-40711](https://intel.threadlinqs.com/cve/CVE-2024-40711) - [CVE-2024-55591](https://intel.threadlinqs.com/cve/CVE-2024-55591) - [CVE-2024-6387](https://intel.threadlinqs.com/cve/CVE-2024-6387) - [CVE-2025-68686](https://intel.threadlinqs.com/cve/CVE-2025-68686) - [CVE-2026-0310](https://intel.threadlinqs.com/cve/CVE-2026-0310) - [CVE-2026-25815](https://intel.threadlinqs.com/cve/CVE-2026-25815) ## Detection coverage Threadlinqs maintains 20 detection rules mapped to T1602.002 (SPL 8, KQL 6, Sigma 6). Rule content is available to Blue tier accounts and above; this page shows counts only. 20 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1602 Data from Configuration Repository](https://intel.threadlinqs.com/technique/T1602) — 25 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1602.002 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)