Activity timeline
T1114 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 39 reports, and 129 of the 129 threats were reported in the twelve months to 2026-10.
How adversaries use it
T1114 Email Collection is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix. Threadlinqs maps 129 of 2623 tracked threats (4.9%) to it; by severity that is 39 critical, 74 high, 16 medium.
Threats that use T1114 most often also use T1566 Phishing (81 threats), T1027 Obfuscated Files or Information (67 threats), T1071 Application Layer Protocol (65 threats), T1583 Acquire Infrastructure (59 threats), T1567 Exfiltration Over Web Service (56 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.
49 tracked threat actors appear in the threats that use T1114; the most frequent are APT28 (9), Forest Blizzard (8), BlueDelta (7), APT29 (4), ShinyHunters (4).
Mitigations
MITRE ATT&CK lists 4 mitigations for T1114.
Data sources
Telemetry that can reveal T1114, per MITRE ATT&CK.
- Application Log — Application Log Content
- Command — Command Execution
- File — File Access
- Logon Session — Logon Session Creation
- Network Traffic — Network Connection Creation
Threat actors using it
Tracked threats
The 30 most recent of 129 tracked threats that use T1114.
- Microsoft Reissues September 2026 Exchange Server Updates (V2) for CVE-2026-96940 Mailbox Authorization Flawhigh
- Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attackscritical
- CVE-2026-74864 / CVE-2026-74865: Authentication bypass in YunoHost-Apps sogo_yhn (SOGo proxy-auth trust)critical
- Former US Air Force Members Odimegwu and Mogaji Sentenced Over Phishing-Driven BEC Fraud Ring Targeting 15+…medium
- Hacker-for-Hire Economy: Cyber Mercenaries Offer Account Compromise, Surveillance, Doxxing and DDoS as a…medium
- AI-Powered Cyber Attacks: Emerging TTPs Across Phishing, Deepfake BEC, Polymorphic Malware, and Prompt…medium
- Cyberattack Disrupts Dyfed-Powys Police Systems in Wales, Staff Data Possibly Compromisedmedium
- Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and…high
- CISA Adds Actively Exploited Cisco Secure Email Gateway SQL Injection (CVE-2026-76461) to KEV Catalogcritical
- Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated…critical
- Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi…high
- September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days…critical
- PEAR ransomware group claims data leak from South Plains Rural Health Services (SPRHS)high
- Emperador ransomware group claims breach of Uniguaçu (Brazilian education sector)medium
- ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodologyhigh
- Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU Organizations, Abusing Microsoft 365 Login Flowshigh
- iAuthFlow V2 Phishing Toolkit Enrolls Attacker-Controlled Passkeys That Survive Password Resetshigh
- Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injectioncritical
- Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From…critical
- Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage…high
- OAuth-Token Supply-Chain Compromise Enables Attacker Access to Google Workspace: The Vercel and Composio…high
- UNC6671 Rebrands BlackFile into Redact, Pink, Helix, Falcon: Vishing + AiTM Campaign Steals M365/Okta Data…high
- Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accountshigh
- Greatness PhaaS — AiTM phishing platform targeting Microsoft 365 and multi-platform credentials via spoofed…high
- Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials…high
- AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scalemedium
- ModernStealer: Cross-Platform Dark Web/Telegram Broker Network Claims Sale of Government and Defense Datamedium
- Mon General Hospital (West Virginia) Notifies Patients After May 2026 Phishing Attack Compromises Employee…high
- CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver…high
- Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeyshigh
Detection coverage
Threadlinqs maintains 95 detection rules mapped to T1114 (SPL 27, KQL 37, Sigma 31). Rule content is available to Blue tier accounts and above; this page shows counts only.
Sub-techniques
- T1114.001 Local Email Collection — 13 tracked threats
- T1114.002 Remote Email Collection — 46 tracked threats
- T1114.003 Email Forwarding Rule — 15 tracked threats