# T1606.001 Web Cookies > As of 2026-10-22, T1606.001 (Web Cookies) appears in 12 tracked threats, first reported 2026-04-27 and most recently 2026-10-18, with linked actors including APT28, APT38, Andariel; it most often appears alongside T1190 (Exploit Public-Facing Application). - **Tracked threats:** 12 (8 critical, 4 high) - **First seen:** 2026-04-27 - **Last seen:** 2026-10-18 - **Threat actors:** 8 - **Detection rules:** 36 (counts only; Blue tier and above) ## Key facts - **ID:** T1606.001 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Parent:** T1606 - **Data as of:** 2026-10-22 - **MITRE:** https://attack.mitre.org/techniques/T1606/001/ ## Activity timeline T1606.001 first appeared in tracked threats on 2026-04-27 and was most recently reported on 2026-10-18. The busiest month was 2026-10 with 4 reports, and 12 of the 12 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1606.001 Web Cookies is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1606 Forge Web Credentials](https://intel.threadlinqs.com/technique/T1606). Threadlinqs maps 12 of 3142 tracked threats (0.4%) to it; by severity that is 8 critical, 4 high. Threats that use T1606.001 most often also use [T1190 Exploit Public-Facing Application](https://intel.threadlinqs.com/technique/T1190) (10 threats), [T1550.004 Web Session Cookie](https://intel.threadlinqs.com/technique/T1550.004) (8 threats), [T1212 Exploitation for Credential Access](https://intel.threadlinqs.com/technique/T1212) (6 threats), [T1078 Valid Accounts](https://intel.threadlinqs.com/technique/T1078) (5 threats), [T1595.002 Vulnerability Scanning](https://intel.threadlinqs.com/technique/T1595.002) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 8 tracked threat actors appear in the threats that use T1606.001; the most frequent are [APT28](https://intel.threadlinqs.com/actor/APT28) (1), [APT38](https://intel.threadlinqs.com/actor/APT38) (1), [Andariel](https://intel.threadlinqs.com/actor/Andariel) (1), [DriveSurge](https://intel.threadlinqs.com/actor/DriveSurge) (1), [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) (1). ## Mitigations MITRE ATT&CK lists 2 mitigations for T1606.001. - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) - [M1054 Software Configuration](https://attack.mitre.org/mitigations/M1054/) ## Data sources Telemetry that can reveal T1606.001, per MITRE ATT&CK. - Logon Session — Logon Session Creation - Web Credential — Web Credential Usage ## Threat actors using it - [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 - [APT38](https://intel.threadlinqs.com/actor/APT38) — 1 - [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 - [DriveSurge](https://intel.threadlinqs.com/actor/DriveSurge) — 1 - [Gamaredon](https://intel.threadlinqs.com/actor/Gamaredon) — 1 - [Greatness PhaaS Operators](https://intel.threadlinqs.com/actor/Greatness%20PhaaS%20Operators) — 1 - [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1 - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 1 ## Tracked threats 12 tracked threats use T1606.001. - [Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell…](https://intel.threadlinqs.com/threat/TL-2026-3850) — high — 2026-10-18 - [Google DevSite Flask Session Pickle Deserialization RCE (Unauthenticated) - OAuth Client Secret Reused as…](https://intel.threadlinqs.com/threat/TL-2026-3355) — critical — 2026-10-12 - [Rejetto HTTP File Server (HFS) 3.x session forgery via predictable Math.random() signing key leads to…](https://intel.threadlinqs.com/threat/TL-2026-2865) — critical — 2026-10-03 - [Forgeable Session Cookie (Hard-Coded HMAC Secret) in Yard Management System Bypasses Entra ID MFA and…](https://intel.threadlinqs.com/threat/TL-2026-2892) — high — 2026-10-02 - [Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse…](https://intel.threadlinqs.com/threat/TL-2026-2300) — critical — 2026-09-02 - [CVE-2026-69836: Unauthenticated Remote Code Execution in Microsoft Entra ID via Deserialization of Untrusted…](https://intel.threadlinqs.com/threat/TL-2026-2107) — critical — 2026-08-22 - [Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign…](https://intel.threadlinqs.com/threat/TL-2026-1871) — high — 2026-08-04 - [CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated…](https://intel.threadlinqs.com/threat/TL-2026-1755) — critical — 2026-07-29 - [Palo Alto Networks PAN-OS / Prisma Access GlobalProtect Authentication Bypass (CVE-2026-0257) — Active…](https://intel.threadlinqs.com/threat/TL-2026-0631) — critical — 2026-05-29 - [VaultJacking — Google Password Manager Vault Theft via Single Captured 6-Digit PIN (PhishU Framework)](https://intel.threadlinqs.com/threat/TL-2026-0620) — high — 2026-05-28 - [Sorry Ransomware Mass Exploitation of cPanel/WHM Authentication Bypass CVE-2026-41940 (44,000+ Servers…](https://intel.threadlinqs.com/threat/TL-2026-0449) — critical — 2026-05-02 - [ASP.NET Core Data Protection Authentication Cookie Forgery / Privilege Escalation (CVE-2026-40372)](https://intel.threadlinqs.com/threat/TL-2026-0427) — critical — 2026-04-27 ## Related CVEs CVEs referenced by the tracked threats that use T1606.001, most frequent first. - [CVE-2026-0257](https://intel.threadlinqs.com/cve/CVE-2026-0257) - [CVE-2023-27532](https://intel.threadlinqs.com/cve/CVE-2023-27532) - [CVE-2025-24293](https://intel.threadlinqs.com/cve/CVE-2025-24293) - [CVE-2025-55182](https://intel.threadlinqs.com/cve/CVE-2025-55182) - [CVE-2025-8088](https://intel.threadlinqs.com/cve/CVE-2025-8088) - [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509) - [CVE-2026-33829](https://intel.threadlinqs.com/cve/CVE-2026-33829) - [CVE-2026-40372](https://intel.threadlinqs.com/cve/CVE-2026-40372) - [CVE-2026-41940](https://intel.threadlinqs.com/cve/CVE-2026-41940) - [CVE-2026-61500](https://intel.threadlinqs.com/cve/CVE-2026-61500) - [CVE-2026-61501](https://intel.threadlinqs.com/cve/CVE-2026-61501) - [CVE-2026-66066](https://intel.threadlinqs.com/cve/CVE-2026-66066) - [CVE-2026-69836](https://intel.threadlinqs.com/cve/CVE-2026-69836) - [CVE-2026-9586](https://intel.threadlinqs.com/cve/CVE-2026-9586) ## Detection coverage Threadlinqs maintains 36 detection rules mapped to T1606.001 (SPL 19, KQL 7, Sigma 10). Rule content is available to Blue tier accounts and above; this page shows counts only. 36 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1606 Forge Web Credentials](https://intel.threadlinqs.com/technique/T1606) — 97 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1606.001 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)