# T1071.001 Web Protocols > As of 2026-10-05, T1071.001 (Web Protocols) appears in 690 tracked threats, first reported 2026-01-01 and most recently 2026-10-04, with linked actors including APT38, TeamPCP, Sapphire Sleet; it most often appears alongside T1027 (Obfuscated Files or Information). - **Tracked threats:** 690 (177 critical, 453 high, 58 medium) - **First seen:** 2026-01-01 - **Last seen:** 2026-10-04 - **Threat actors:** 169 - **Detection rules:** 2858 (counts only; Blue tier and above) ## Key facts - **ID:** T1071.001 - **Framework:** MITRE ATT&CK - **Tactics:** Command and Control - **Matrix:** Enterprise - **Parent:** T1071 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1071/001/ ## Activity timeline T1071.001 first appeared in tracked threats on 2026-01-01 and was most recently reported on 2026-10-04. The busiest month was 2026-07 with 213 reports, and 690 of the 690 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1071.001 Web Protocols is catalogued by MITRE ATT&CK under the Command and Control tactic in the Enterprise matrix, as a sub-technique of [T1071 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1071). Threadlinqs maps 690 of 2623 tracked threats (26.3%) to it; by severity that is 177 critical, 453 high, 58 medium. Threats that use T1071.001 most often also use [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (402 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (395 threats), [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (372 threats), [T1041 Exfiltration Over C2 Channel](https://intel.threadlinqs.com/technique/T1041) (329 threats), [T1036.005 Match Legitimate Resource Name or Location](https://intel.threadlinqs.com/technique/T1036.005) (326 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 169 tracked threat actors appear in the threats that use T1071.001; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (25), [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) (20), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (18), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (18), [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) (14). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1071.001. - [M1031 Network Intrusion Prevention](https://attack.mitre.org/mitigations/M1031/) - [M1037 Filter Network Traffic](https://attack.mitre.org/mitigations/M1037/) ## Data sources Telemetry that can reveal T1071.001, per MITRE ATT&CK. - Network Traffic — Network Traffic Content, Network Traffic Flow ## Threat actors using it - [APT38](https://intel.threadlinqs.com/actor/APT38) — 25 - [TeamPCP](https://intel.threadlinqs.com/actor/TeamPCP) — 20 - [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 18 - [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 18 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 14 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 13 - [APT28](https://intel.threadlinqs.com/actor/APT28) — 10 - [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 9 - [UNC1069](https://intel.threadlinqs.com/actor/UNC1069) — 9 - [APT43](https://intel.threadlinqs.com/actor/APT43) — 8 - [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 8 - [WageMole](https://intel.threadlinqs.com/actor/WageMole) — 7 ## Tracked threats The 30 most recent of 690 tracked threats that use T1071.001. - [Milk Dragon (NaiLong) Phishing-as-a-Service Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass…](https://intel.threadlinqs.com/threat/TL-2026-2919) — high — 2026-10-04 - [Milk Dragon (NaiLong) AiTM Phishing-as-a-Service Kit Uses Real-Time OTP Relay and WebSocket Keylogging to…](https://intel.threadlinqs.com/threat/TL-2026-2901) — high — 2026-10-04 - [TIKTOUK Toolkit Harvests AWS, SMTP and Database Credentials from Exposed WordPress Backups and Config Files…](https://intel.threadlinqs.com/threat/TL-2026-2889) — high — 2026-10-04 - [AI-accelerated intrusions: Microsoft 2026 Digital Defense Report on phishing, public-facing app…](https://intel.threadlinqs.com/threat/TL-2026-2880) — high — 2026-10-03 - [ClickFix Campaign Uses Fake CAPTCHA Lures and Browser-Cache Staging to Execute Malicious Commands on Windows…](https://intel.threadlinqs.com/threat/TL-2026-2858) — high — 2026-10-03 - [CloudSyncD macOS Backdoor Delivered via Fake Zoom Installer](https://intel.threadlinqs.com/threat/TL-2026-2840) — high — 2026-10-02 - [Milk Dragon (NaiLong) AiTM Phishing-as-a-Service Kit Targeting Social Media Shoppers and Bank MFA](https://intel.threadlinqs.com/threat/TL-2026-2834) — high — 2026-10-01 - [ScreenConnect Client Abused by Attackers via Mejuri-Themed Payment Receipt Phishing](https://intel.threadlinqs.com/threat/TL-2026-2826) — medium — 2026-10-01 - [Coordinated Campaign of 32 Malicious Chrome/Edge Productivity Extensions Conducting Surveillance and…](https://intel.threadlinqs.com/threat/TL-2026-2821) — medium — 2026-10-01 - [2CLoader: New Malware Loader Delivering Vidar, Remus and XWorm](https://intel.threadlinqs.com/threat/TL-2026-2819) — high — 2026-09-30 - [Mini Shai-Hulud: Compromised @antv npm Packages Steal Developer and CI/CD Credentials (TeamPCP)](https://intel.threadlinqs.com/threat/TL-2026-2806) — high — 2026-09-30 - [Star Blizzard (FSB) RedFlick mass-phishing campaigns deliver CosmicPulse backdoor, expanding beyond Ukraine](https://intel.threadlinqs.com/threat/TL-2026-2795) — high — 2026-09-29 - [Phishing Campaigns Abuse RMM Tools (MSP360, ScreenConnect) for Persistent Access](https://intel.threadlinqs.com/threat/TL-2026-2788) — high — 2026-09-29 - [Star Blizzard (SEABORGIUM) RedFlick technique: scheduled-task backdoor delivery via phishing (CosmicPulse)](https://intel.threadlinqs.com/threat/TL-2026-2787) — high — 2026-09-29 - [North Korea-Linked XCTDH/OmniStealer Campaign Uses Ethereum Transactions (HashHiding) for Covert C2 Signaling](https://intel.threadlinqs.com/threat/TL-2026-2782) — high — 2026-09-29 - [OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX Installers](https://intel.threadlinqs.com/threat/TL-2026-2767) — high — 2026-09-29 - [ShinyHunters Claims Breach of FBI Jobs Portal (fbijobs.gov) via Alleged Oracle PeopleSoft Zero-Day, Exposing…](https://intel.threadlinqs.com/threat/TL-2026-2760) — high — 2026-09-28 - [Poper Blocker Chrome Extension Spyware: Big Star Labs' 'Featured' Ad Blocker Exfiltrates Browsing History…](https://intel.threadlinqs.com/threat/TL-2026-2739) — high — 2026-09-28 - [NeedyMantis: Storm-3069 Post-Compromise Modular Malware in Targeted Operations](https://intel.threadlinqs.com/threat/TL-2026-2733) — high — 2026-09-28 - [CVE-2019-18935 Telerik UI Deserialization Exploited to Deploy Web Shells and a WordPress Scanner on IIS…](https://intel.threadlinqs.com/threat/TL-2026-2726) — critical — 2026-09-28 - [CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2711) — critical — 2026-09-27 - [Infostealer Market Resilience: Law Enforcement Takedowns Displace, Not Eliminate…](https://intel.threadlinqs.com/threat/TL-2026-2708) — medium — 2026-09-27 - [Citrix Patches Two Actively Exploited NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772)](https://intel.threadlinqs.com/threat/TL-2026-2703) — critical — 2026-09-27 - [ClickFix Campaign Abuses Compromised Ukrainian Websites to Deploy Psychedelic Stealer](https://intel.threadlinqs.com/threat/TL-2026-2699) — high — 2026-09-27 - [Kiteworks Urges Customers to Shut Down Systems After Federal Threat Intelligence Warning of Possible…](https://intel.threadlinqs.com/threat/TL-2026-2690) — critical — 2026-09-27 - [The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments](https://intel.threadlinqs.com/threat/TL-2026-2687) — high — 2026-09-27 - [Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix…](https://intel.threadlinqs.com/threat/TL-2026-2685) — high — 2026-09-27 - [PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence](https://intel.threadlinqs.com/threat/TL-2026-2674) — high — 2026-09-26 - [Malicious Google Ads Campaign Targets Ledger Hardware Wallet Users to Steal BIP-39 Recovery Phrases via…](https://intel.threadlinqs.com/threat/TL-2026-2673) — high — 2026-09-26 - [CISA Adds Two Actively Exploited KEVs: SharePoint Code Injection (CVE-2026-65660) and Mikrotik RouterOS Auth…](https://intel.threadlinqs.com/threat/TL-2026-2669) — critical — 2026-09-26 ## Related CVEs CVEs referenced by the tracked threats that use T1071.001, most frequent first. - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2021-29441](https://intel.threadlinqs.com/cve/CVE-2021-29441) - [CVE-2025-3248](https://intel.threadlinqs.com/cve/CVE-2025-3248) - [CVE-2026-15409](https://intel.threadlinqs.com/cve/CVE-2026-15409) - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) - [CVE-2026-15410](https://intel.threadlinqs.com/cve/CVE-2026-15410) - [CVE-2026-45659](https://intel.threadlinqs.com/cve/CVE-2026-45659) - [CVE-2026-55040](https://intel.threadlinqs.com/cve/CVE-2026-55040) - [CVE-2026-60137](https://intel.threadlinqs.com/cve/CVE-2026-60137) - [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030) - [CVE-2021-26855](https://intel.threadlinqs.com/cve/CVE-2021-26855) - [CVE-2026-32201](https://intel.threadlinqs.com/cve/CVE-2026-32201) - [CVE-2026-45321](https://intel.threadlinqs.com/cve/CVE-2026-45321) - [CVE-2026-56164](https://intel.threadlinqs.com/cve/CVE-2026-56164) - [CVE-2026-58644](https://intel.threadlinqs.com/cve/CVE-2026-58644) - [CVE-2021-31207](https://intel.threadlinqs.com/cve/CVE-2021-31207) - [CVE-2021-34473](https://intel.threadlinqs.com/cve/CVE-2021-34473) - [CVE-2021-34523](https://intel.threadlinqs.com/cve/CVE-2021-34523) - [CVE-2022-41040](https://intel.threadlinqs.com/cve/CVE-2022-41040) - [CVE-2022-41082](https://intel.threadlinqs.com/cve/CVE-2022-41082) - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2025-9491](https://intel.threadlinqs.com/cve/CVE-2025-9491) - [CVE-2025-9501](https://intel.threadlinqs.com/cve/CVE-2025-9501) - [CVE-2026-10520](https://intel.threadlinqs.com/cve/CVE-2026-10520) - [CVE-2026-1731](https://intel.threadlinqs.com/cve/CVE-2026-1731) - [CVE-2026-34908](https://intel.threadlinqs.com/cve/CVE-2026-34908) - [CVE-2026-34909](https://intel.threadlinqs.com/cve/CVE-2026-34909) - [CVE-2026-34910](https://intel.threadlinqs.com/cve/CVE-2026-34910) - [CVE-2020-0688](https://intel.threadlinqs.com/cve/CVE-2020-0688) - [CVE-2020-1472](https://intel.threadlinqs.com/cve/CVE-2020-1472) ## Detection coverage Threadlinqs maintains 2858 detection rules mapped to T1071.001 (SPL 1068, KQL 862, Sigma 925, other 3). Rule content is available to Blue tier accounts and above; this page shows counts only. 2858 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1071 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1071) — 859 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1071.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)