Activity timeline
T1685.002 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 8 reports, and 11 of the 11 threats were reported in the twelve months to 2026-07.
How adversaries use it
T1685.002 Disable or Modify Cloud Log is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix, as a sub-technique of T1685 Disable or Modify Tools. Threadlinqs maps 11 of 2623 tracked threats (0.4%) to it; by severity that is 4 critical, 7 high.
Threats that use T1685.002 most often also use T1036.005 Match Legitimate Resource Name or Location (5 threats), T1078.004 Cloud Accounts (5 threats), T1087.004 Cloud Account (5 threats), T1190 Exploit Public-Facing Application (5 threats), T1016 System Network Configuration Discovery (4 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
8 tracked threat actors appear in the threats that use T1685.002; the most frequent are EvilTokens (1), INC Ransom (1), INC Ransom - G1032 (1), Lynx (1), Static Tundra (1).
Threat actors using it
Tracked threats
11 tracked threats use T1685.002.
- Royal Ransomware Uses Qbot and Cobalt Strike to Rapidly Compromise Windows Domainshigh
- Starland RAT Campaign (UAT-11795) — Trojanized WebEx, Zoom, MobaXterm, DBeaver & FACEIT Installers Deliver…high
- OAuth Client ID Spoofing Enables Silent Credential Validation Against Microsoft Entra ID — UNK_pyreq2323 &…high
- NSA/FBI Joint Advisory: Disable Cisco Smart Install to Block Russian FSB "Static Tundra" Exploitation of…critical
- GigaWiper (BLUERABBIT): Golang Backdoor Bundling Physical-Disk Wiping, Crucio-Derived Fake Ransomware, and…high
- FortiBleed: Mass Credential Compromise Campaign Against Internet-Exposed Fortinet FortiGate Devices (86,644…critical
- BeyondTrust Microsoft Vulnerabilities Report 2026: Critical Flaws More Than Double as Elevation of Privilege…high
- ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens…high
- Cisco Secure Workload CVE-2026-20223 — Maximum-Severity Unauthenticated Site Admin Privilege Escalation via…critical
- Storm-2949 Cloud-Wide Breach — SSPR Abuse & Azure RBAC Lateral Movement to Mass Data Exfiltrationcritical
- CVE-2024-3393 PAN-OS DNS Security DoS — Unauthenticated Firewall Crash Forces Maintenance Mode, Perimeter…high
Detection coverage
Threadlinqs maintains 18 detection rules mapped to T1685.002 (SPL 5, KQL 8, Sigma 5). Rule content is available to Blue tier accounts and above; this page shows counts only.
Parent technique
T1685 Disable or Modify Tools — 750 tracked threats at the technique level.