T1602.002: Network Device Configuration Dump
Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.
Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.[1][2] These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
Analyst context for executives and security teams
Network device configuration dumps matter because router, switch, and other network device configs can expose the map of the environment, software details, legitimate accounts, and credentials. For leaders, this is not just a device-hardening issue; it can affect incident scope, resilience of core connectivity, and the attacker’s ability to plan later access using trusted infrastructure knowledge.
Executive priority
Prioritize this where network devices support critical business operations, remote administration, telecom/ISP functions, or operational technology connectivity. The key executive question is whether management access to network devices is segmented, monitored, and auditable enough to prove that configuration repositories and exports are not an easy collection source. ATT&CK relationships also connect this technique to infrastructure-focused threat activity, making it relevant to cyber-physical and business-continuity risk discussions when network devices underpin critical services.
Technical view
This is an enterprise ATT&CK collection sub-technique for Network Devices under Data from Configuration Repository. Defenders should validate monitoring around access to running and stored device configurations, management protocols such as SNMP and Smart Install, and any tooling that can query or export network device configuration data. Because ATT&CK provides no official detection text for this object, teams should anchor validation to DET0233, which detects configuration dump behavior via configuration repositories, and then test whether local device logs, repository logs, network flows, and intrusion monitoring can distinguish legitimate administration from unusual bulk reads, exports, or access from unexpected management sources.
Likely telemetry
- Network device authentication and authorization logs
- Network device configuration access, change, and export events
- Configuration repository access logs and audit trails
- Management-plane network flow records
- SNMP and Smart Install related traffic where present
Detection direction
- Confirm which network devices produce auditable events for reading, exporting, or copying running and startup configurations.
- Baseline legitimate configuration backup jobs, network management platforms, and administrator source addresses before alerting on config reads or exports.
- Monitor management protocols and repositories for access from non-management segments or unexpected accounts.
- Tune for high-signal conditions such as configuration export outside normal backup windows, repeated config queries, or access to many devices from one source.
- Account for false positives from approved backup, compliance, and network automation tooling.
Mitigation priorities
- Segment network device management planes and restrict access to authorized administration networks, aligning with M1030 Network Segmentation.
- Filter ingress, egress, and lateral management traffic so protocols used to access configurations are only reachable from approved sources, aligning with M1037 Filter Network Traffic.
- Use network intrusion prevention or detection at network boundaries where signatures or policy controls can block or alert on unauthorized management traffic, aligning with M1031.
- Protect sensitive configuration contents at rest and in transit where supported, aligning with M1041 Encrypt Sensitive Information.
- Keep network device software and firmware updated, aligning with M1051 Update Software.
Analyst notes and limits
The ATT&CK record includes relationships to DET0233, mitigations M1030, M1031, M1037, M1041, M1051, and M1054, parent technique T1602, and use relationships for C0063, G1045, and S9010. Use those relationships as prioritization context, not as proof that any specific environment is exposed or compromised. The supplied platform for this technique is Network Devices.
MITRE provides no official detection text for this object, so detection guidance must be validated against local logging, device models, management architecture, and repository practices. The supplied data does not justify vendor-specific fixes, guaranteed detection coverage, or claims of current exploitation against a given organization.
Network Device Configuration Dump
Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.
Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.[1][2] These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1602 | Data from Configuration Repository | This object subtechnique of Data from Configuration Repository. |
Groups, software, and campaigns
G1045: Salt Typhoon
Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).[1][2]
S9010: GlassWorm
GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]
C0063: 2025 Poland Wiper Attacks
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | a0c811dfcf0e… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
US-CERT TA18-106A Network Infrastructure Devices 2018
US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Open source URL -
[2]
Cisco Blog Legacy Device Attacks
Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.
Open source URL -
[3]
US-CERT TA18-068A 2018
US-CERT. (2018, March 27). TA18-068A Brute Force Attacks Conducted by Cyber Actors. Retrieved October 2, 2019.
Open source URL -
[4]
mitre-attack T1602.002Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.