# T1114.003 Email Forwarding Rule > As of 2026-10-05, T1114.003 (Email Forwarding Rule) appears in 15 tracked threats, first reported 2026-05-22 and most recently 2026-10-01, with linked actors including EvilTokens, Greatness PhaaS Operators, Kali365; it most often appears alongside T1078.004 (Cloud Accounts). - **Tracked threats:** 15 (3 critical, 12 high) - **First seen:** 2026-05-22 - **Last seen:** 2026-10-01 - **Threat actors:** 11 - **Detection rules:** 38 (counts only; Blue tier and above) ## Key facts - **ID:** T1114.003 - **Framework:** MITRE ATT&CK - **Tactics:** Collection - **Matrix:** Enterprise - **Parent:** T1114 - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1114/003/ ## Activity timeline T1114.003 first appeared in tracked threats on 2026-05-22 and was most recently reported on 2026-10-01. The busiest month was 2026-07 with 6 reports, and 15 of the 15 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1114.003 Email Forwarding Rule is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix, as a sub-technique of [T1114 Email Collection](https://intel.threadlinqs.com/technique/T1114). Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 3 critical, 12 high. Threats that use T1114.003 most often also use [T1078.004 Cloud Accounts](https://intel.threadlinqs.com/technique/T1078.004) (11 threats), [T1566.002 Spearphishing Link](https://intel.threadlinqs.com/technique/T1566.002) (11 threats), [T1528 Steal Application Access Token](https://intel.threadlinqs.com/technique/T1528) (10 threats), [T1087.004 Cloud Account](https://intel.threadlinqs.com/technique/T1087.004) (9 threats), [T1204.001 Malicious Link](https://intel.threadlinqs.com/technique/T1204.001) (9 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 11 tracked threat actors appear in the threats that use T1114.003; the most frequent are [EvilTokens](https://intel.threadlinqs.com/actor/EvilTokens) (2), [Greatness PhaaS Operators](https://intel.threadlinqs.com/actor/Greatness%20PhaaS%20Operators) (1), [Kali365](https://intel.threadlinqs.com/actor/Kali365) (1), [Kali365 PhaaS operators](https://intel.threadlinqs.com/actor/Kali365%20PhaaS%20operators) (1), [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) (1). ## Mitigations MITRE ATT&CK lists 4 mitigations for T1114.003. - [M1041 Encrypt Sensitive Information](https://attack.mitre.org/mitigations/M1041/) - [M1042 Disable or Remove Feature or Program](https://attack.mitre.org/mitigations/M1042/) - [M1047 Audit](https://attack.mitre.org/mitigations/M1047/) - [M1060 Out-of-Band Communications Channel](https://attack.mitre.org/mitigations/M1060/) ## Data sources Telemetry that can reveal T1114.003, per MITRE ATT&CK. - Application Log — Application Log Content - Cloud Service — Cloud Service Metadata - Command — Command Execution ## Threat actors using it - [EvilTokens](https://intel.threadlinqs.com/actor/EvilTokens) — 2 - [Greatness PhaaS Operators](https://intel.threadlinqs.com/actor/Greatness%20PhaaS%20Operators) — 1 - [Kali365](https://intel.threadlinqs.com/actor/Kali365) — 1 - [Kali365 PhaaS operators](https://intel.threadlinqs.com/actor/Kali365%20PhaaS%20operators) — 1 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 1 - [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 1 - [Storm-2372](https://intel.threadlinqs.com/actor/Storm-2372) — 1 - [Storm-2992](https://intel.threadlinqs.com/actor/Storm-2992) — 1 - [UNC6508](https://intel.threadlinqs.com/actor/UNC6508) — 1 - [UTA0304](https://intel.threadlinqs.com/actor/UTA0304) — 1 - [UTA0307](https://intel.threadlinqs.com/actor/UTA0307) — 1 ## Tracked threats 15 tracked threats use T1114.003. - [Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks](https://intel.threadlinqs.com/threat/TL-2026-2830) — critical — 2026-10-01 - [AI-Enabled Social Engineering and Synthetic Media (Deepfakes) Undermining Identity Verification](https://intel.threadlinqs.com/threat/TL-2026-2774) — high — 2026-09-29 - [Microsoft-Led Coalition Takes Down EvilTokens AI-Powered Phishing-as-a-Service Platform (Storm-2992)](https://intel.threadlinqs.com/threat/TL-2026-2614) — high — 2026-09-22 - [Mass Phishing and Scam Campaign Abuses 450+ Compromised Google Workspace Accounts in the Education Sector](https://intel.threadlinqs.com/threat/TL-2026-2004) — high — 2026-08-13 - [Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidents](https://intel.threadlinqs.com/threat/TL-2026-1938) — high — 2026-08-08 - [Greatness PhaaS Platform Spoofs RingCentral in Adversary-in-the-Middle and Device Code Phishing Campaign…](https://intel.threadlinqs.com/threat/TL-2026-1871) — high — 2026-08-04 - [Operation RoundPress: TA458 Deploys SpyPress Malware via Half-Click Webmail Zero-Days (CVE-2025-27915…](https://intel.threadlinqs.com/threat/TL-2026-2579) — critical — 2026-07-23 - [Kali365 Device-Code Phishing-as-a-Service Hijacks Microsoft 365 and Google Workspace OAuth Tokens to Bypass…](https://intel.threadlinqs.com/threat/TL-2026-1584) — high — 2026-07-21 - [EvilTokens Phishing-as-a-Service Kit Abuses Microsoft Device Code Authentication with AES-GCM "Ghost Code"…](https://intel.threadlinqs.com/threat/TL-2026-1201) — high — 2026-07-11 - [Zimbra Collaboration Suite Critical Stored XSS in Classic Web Client (Patched in ZCS 10.1.19)](https://intel.threadlinqs.com/threat/TL-2026-1176) — critical — 2026-07-10 - [ARToken Phishing Panel Abuses Microsoft OAuth Device Code Flow to Hijack Microsoft 365 Accounts (EvilTokens…](https://intel.threadlinqs.com/threat/TL-2026-1037) — high — 2026-07-01 - [ARToken: Business Email Compromise-as-a-Service Platform Targeting Microsoft 365 (Cisco Talos / EvilTokens…](https://intel.threadlinqs.com/threat/TL-2026-1036) — high — 2026-07-01 - [UNC6508 (PRC-Nexus) Trojanizes Unpatched REDCap Research Servers with INFINITERED Malware to Spy on North…](https://intel.threadlinqs.com/threat/TL-2026-0891) — high — 2026-06-20 - [EvilTokens Phishing-as-a-Service: Microsoft OAuth 2.0 Device Authorization Grant (Device Code) Phishing…](https://intel.threadlinqs.com/threat/TL-2026-0888) — high — 2026-06-20 - [Kali365 PhaaS — Telegram-Distributed Microsoft 365 Device-Code Phishing with OAuth Token Theft & MFA Bypass…](https://intel.threadlinqs.com/threat/TL-2026-0560) — high — 2026-05-22 ## Related CVEs CVEs referenced by the tracked threats that use T1114.003, most frequent first. - [CVE-2023-43770](https://intel.threadlinqs.com/cve/CVE-2023-43770) - [CVE-2024-42009](https://intel.threadlinqs.com/cve/CVE-2024-42009) - [CVE-2025-27915](https://intel.threadlinqs.com/cve/CVE-2025-27915) - [CVE-2025-3929](https://intel.threadlinqs.com/cve/CVE-2025-3929) - [CVE-2025-49113](https://intel.threadlinqs.com/cve/CVE-2025-49113) - [CVE-2026-104286](https://intel.threadlinqs.com/cve/CVE-2026-104286) - [CVE-2026-8496](https://intel.threadlinqs.com/cve/CVE-2026-8496) ## Detection coverage Threadlinqs maintains 38 detection rules mapped to T1114.003 (SPL 14, KQL 13, Sigma 11). Rule content is available to Blue tier accounts and above; this page shows counts only. 38 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1114 Email Collection](https://intel.threadlinqs.com/technique/T1114) — 129 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1114.003 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)