# T1114 Email Collection

> As of 2026-10-05, T1114 (Email Collection) appears in 129 tracked threats, first reported 2026-02-02 and most recently 2026-10-03, with linked actors including APT28, Forest Blizzard, BlueDelta; it most often appears alongside T1566 (Phishing).

- **Tracked threats:** 129 (39 critical, 74 high, 16 medium)
- **First seen:** 2026-02-02
- **Last seen:** 2026-10-03
- **Threat actors:** 49
- **Detection rules:** 95 (counts only; Blue tier and above)

## Key facts

- **ID:** T1114
- **Framework:** MITRE ATT&CK
- **Tactics:** Collection
- **Matrix:** Enterprise
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1114/

## Activity timeline

T1114 first appeared in tracked threats on 2026-02-02 and was most recently reported on 2026-10-03. The busiest month was 2026-07 with 39 reports, and 129 of the 129 threats were reported in the twelve months to 2026-10.

## How adversaries use it

T1114 Email Collection is catalogued by MITRE ATT&CK under the Collection tactic in the Enterprise matrix. Threadlinqs maps 129 of 2623 tracked threats (4.9%) to it; by severity that is 39 critical, 74 high, 16 medium.

Threats that use T1114 most often also use [T1566 Phishing](https://intel.threadlinqs.com/technique/T1566) (81 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (67 threats), [T1071 Application Layer Protocol](https://intel.threadlinqs.com/technique/T1071) (65 threats), [T1583 Acquire Infrastructure](https://intel.threadlinqs.com/technique/T1583) (59 threats), [T1567 Exfiltration Over Web Service](https://intel.threadlinqs.com/technique/T1567) (56 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

49 tracked threat actors appear in the threats that use T1114; the most frequent are [APT28](https://intel.threadlinqs.com/actor/APT28) (9), [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) (8), [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) (7), [APT29](https://intel.threadlinqs.com/actor/APT29) (4), [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) (4).

## Mitigations

MITRE ATT&CK lists 4 mitigations for T1114.

- [M1032 Multi-factor Authentication](https://attack.mitre.org/mitigations/M1032/)
- [M1041 Encrypt Sensitive Information](https://attack.mitre.org/mitigations/M1041/)
- [M1047 Audit](https://attack.mitre.org/mitigations/M1047/)
- [M1060 Out-of-Band Communications Channel](https://attack.mitre.org/mitigations/M1060/)

## Data sources

Telemetry that can reveal T1114, per MITRE ATT&CK.

- Application Log — Application Log Content
- Command — Command Execution
- File — File Access
- Logon Session — Logon Session Creation
- Network Traffic — Network Connection Creation

## Threat actors using it

- [APT28](https://intel.threadlinqs.com/actor/APT28) — 9
- [Forest Blizzard](https://intel.threadlinqs.com/actor/Forest%20Blizzard) — 8
- [BlueDelta](https://intel.threadlinqs.com/actor/BlueDelta) — 7
- [APT29](https://intel.threadlinqs.com/actor/APT29) — 4
- [ShinyHunters](https://intel.threadlinqs.com/actor/ShinyHunters) — 4
- [EvilTokens](https://intel.threadlinqs.com/actor/EvilTokens) — 3
- [Midnight Blizzard](https://intel.threadlinqs.com/actor/Midnight%20Blizzard) — 3
- [Sandworm](https://intel.threadlinqs.com/actor/Sandworm) — 3
- [Scattered LAPSUS$ Hunters](https://intel.threadlinqs.com/actor/Scattered%20LAPSUS%24%20Hunters) — 3
- [Storm-2372](https://intel.threadlinqs.com/actor/Storm-2372) — 3
- [UNC6671](https://intel.threadlinqs.com/actor/UNC6671) — 3
- [Bling Libra](https://intel.threadlinqs.com/actor/Bling%20Libra) — 2

## Tracked threats

The 30 most recent of 129 tracked threats that use T1114.

- [Microsoft Reissues September 2026 Exchange Server Updates (V2) for CVE-2026-96940 Mailbox Authorization Flaw](https://intel.threadlinqs.com/threat/TL-2026-2864) — high — 2026-10-03
- [Fortinet FortiMail critical path traversal flaw CVE-2026-104286 (FG-IR-26-175) exploited in zero-day attacks](https://intel.threadlinqs.com/threat/TL-2026-2830) — critical — 2026-10-01
- [CVE-2026-74864 / CVE-2026-74865: Authentication bypass in YunoHost-Apps sogo_yhn (SOGo proxy-auth trust)](https://intel.threadlinqs.com/threat/TL-2026-2816) — critical — 2026-09-30
- [Former US Air Force Members Odimegwu and Mogaji Sentenced Over Phishing-Driven BEC Fraud Ring Targeting 15+…](https://intel.threadlinqs.com/threat/TL-2026-2792) — medium — 2026-09-29
- [Hacker-for-Hire Economy: Cyber Mercenaries Offer Account Compromise, Surveillance, Doxxing and DDoS as a…](https://intel.threadlinqs.com/threat/TL-2026-2770) — medium — 2026-09-29
- [AI-Powered Cyber Attacks: Emerging TTPs Across Phishing, Deepfake BEC, Polymorphic Malware, and Prompt…](https://intel.threadlinqs.com/threat/TL-2026-2668) — medium — 2026-09-26
- [Cyberattack Disrupts Dyfed-Powys Police Systems in Wales, Staff Data Possibly Compromised](https://intel.threadlinqs.com/threat/TL-2026-2694) — medium — 2026-09-25
- [Iranian MOIS-Linked Actor Uses Telegram-Controlled HEAVYGRAM/CHOSEN BRICK Malware Against Dissidents and…](https://intel.threadlinqs.com/threat/TL-2026-2526) — high — 2026-09-15
- [CISA Adds Actively Exploited Cisco Secure Email Gateway SQL Injection (CVE-2026-76461) to KEV Catalog](https://intel.threadlinqs.com/threat/TL-2026-2508) — critical — 2026-09-14
- [Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated…](https://intel.threadlinqs.com/threat/TL-2026-2466) — critical — 2026-09-12
- [Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi…](https://intel.threadlinqs.com/threat/TL-2026-2446) — high — 2026-09-11
- [September 2026 Microsoft Patch Tuesday — Record 966+ Vulnerabilities with Two Actively Exploited Zero-Days…](https://intel.threadlinqs.com/threat/TL-2026-2398) — critical — 2026-09-08
- [PEAR ransomware group claims data leak from South Plains Rural Health Services (SPRHS)](https://intel.threadlinqs.com/threat/TL-2026-2212) — high — 2026-08-29
- [Emperador ransomware group claims breach of Uniguaçu (Brazilian education sector)](https://intel.threadlinqs.com/threat/TL-2026-2207) — medium — 2026-08-29
- [ADCS ESC1 Privilege Escalation: CISA AA26-237A Red Team Findings and CA Database Hunting Methodology](https://intel.threadlinqs.com/threat/TL-2026-2168) — high — 2026-08-27
- [Mirage2FA Phishing-as-a-Service Surge Hits 4,532 US and EU Organizations, Abusing Microsoft 365 Login Flows](https://intel.threadlinqs.com/threat/TL-2026-2140) — high — 2026-08-25
- [iAuthFlow V2 Phishing Toolkit Enrolls Attacker-Controlled Passkeys That Survive Password Resets](https://intel.threadlinqs.com/threat/TL-2026-2095) — high — 2026-08-21
- [Hackers Target Zimbra Servers in Active Exploitation Campaign via CVE-2026-73570 SNMP Command Injection](https://intel.threadlinqs.com/threat/TL-2026-2082) — critical — 2026-08-20
- [Critical Microsoft Copilot CoSnitch Vulnerability (CVE-2026-24301) Enabled One-Click Data Theft From…](https://intel.threadlinqs.com/threat/TL-2026-2065) — critical — 2026-08-19
- [Russia (GRU Unit 26165 / APT28) Runs Multi-Vector Surveillance, Intimidation, Sabotage and Cyber Espionage…](https://intel.threadlinqs.com/threat/TL-2026-2031) — high — 2026-08-16
- [OAuth-Token Supply-Chain Compromise Enables Attacker Access to Google Workspace: The Vercel and Composio…](https://intel.threadlinqs.com/threat/TL-2026-2018) — high — 2026-08-14
- [UNC6671 Rebrands BlackFile into Redact, Pink, Helix, Falcon: Vishing + AiTM Campaign Steals M365/Okta Data…](https://intel.threadlinqs.com/threat/TL-2026-1962) — high — 2026-08-09
- [Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts](https://intel.threadlinqs.com/threat/TL-2026-1953) — high — 2026-08-09
- [Greatness PhaaS — AiTM phishing platform targeting Microsoft 365 and multi-platform credentials via spoofed…](https://intel.threadlinqs.com/threat/TL-2026-1895) — high — 2026-08-05
- [Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials…](https://intel.threadlinqs.com/threat/TL-2026-1888) — high — 2026-08-05
- [AWS Security Hub Extended Supply Chain Security — Open Source Malware Defense at Cloud Scale](https://intel.threadlinqs.com/threat/TL-2026-1867) — medium — 2026-08-04
- [ModernStealer: Cross-Platform Dark Web/Telegram Broker Network Claims Sale of Government and Defense Data](https://intel.threadlinqs.com/threat/TL-2026-1836) — medium — 2026-08-03
- [Mon General Hospital (West Virginia) Notifies Patients After May 2026 Phishing Attack Compromises Employee…](https://intel.threadlinqs.com/threat/TL-2026-1810) — high — 2026-08-01
- [CaptiveCrunch: Storm-2945 (Midnight Blizzard sub-cluster) Hijacks Hotel Wi-Fi Captive Portals to Deliver…](https://intel.threadlinqs.com/threat/TL-2026-1808) — high — 2026-07-31
- [Device Code Phishing: OAuth Device Authorization Grant Abuse Bypasses All MFA Forms, Including Passkeys](https://intel.threadlinqs.com/threat/TL-2026-1793) — high — 2026-07-31

## Related CVEs

CVEs referenced by the tracked threats that use T1114, most frequent first.

- [CVE-2026-21509](https://intel.threadlinqs.com/cve/CVE-2026-21509)
- [CVE-2020-12641](https://intel.threadlinqs.com/cve/CVE-2020-12641)
- [CVE-2020-35730](https://intel.threadlinqs.com/cve/CVE-2020-35730)
- [CVE-2021-44026](https://intel.threadlinqs.com/cve/CVE-2021-44026)
- [CVE-2023-23397](https://intel.threadlinqs.com/cve/CVE-2023-23397)
- [CVE-2023-38831](https://intel.threadlinqs.com/cve/CVE-2023-38831)
- [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887)
- [CVE-2026-25253](https://intel.threadlinqs.com/cve/CVE-2026-25253)
- [CVE-2026-42897](https://intel.threadlinqs.com/cve/CVE-2026-42897)
- [CVE-2012-1823](https://intel.threadlinqs.com/cve/CVE-2012-1823)
- [CVE-2017-11317](https://intel.threadlinqs.com/cve/CVE-2017-11317)
- [CVE-2017-3506](https://intel.threadlinqs.com/cve/CVE-2017-3506)
- [CVE-2017-6742](https://intel.threadlinqs.com/cve/CVE-2017-6742)
- [CVE-2019-18935](https://intel.threadlinqs.com/cve/CVE-2019-18935)
- [CVE-2021-1048](https://intel.threadlinqs.com/cve/CVE-2021-1048)
- [CVE-2021-22205](https://intel.threadlinqs.com/cve/CVE-2021-22205)
- [CVE-2021-37973](https://intel.threadlinqs.com/cve/CVE-2021-37973)
- [CVE-2021-37976](https://intel.threadlinqs.com/cve/CVE-2021-37976)
- [CVE-2021-38000](https://intel.threadlinqs.com/cve/CVE-2021-38000)
- [CVE-2021-38003](https://intel.threadlinqs.com/cve/CVE-2021-38003)
- [CVE-2023-2033](https://intel.threadlinqs.com/cve/CVE-2023-2033)
- [CVE-2023-2136](https://intel.threadlinqs.com/cve/CVE-2023-2136)
- [CVE-2023-22527](https://intel.threadlinqs.com/cve/CVE-2023-22527)
- [CVE-2023-3079](https://intel.threadlinqs.com/cve/CVE-2023-3079)
- [CVE-2023-41991](https://intel.threadlinqs.com/cve/CVE-2023-41991)
- [CVE-2023-41992](https://intel.threadlinqs.com/cve/CVE-2023-41992)
- [CVE-2023-41993](https://intel.threadlinqs.com/cve/CVE-2023-41993)
- [CVE-2023-43770](https://intel.threadlinqs.com/cve/CVE-2023-43770)
- [CVE-2023-46805](https://intel.threadlinqs.com/cve/CVE-2023-46805)
- [CVE-2023-4762](https://intel.threadlinqs.com/cve/CVE-2023-4762)

## Detection coverage

Threadlinqs maintains 95 detection rules mapped to T1114 (SPL 27, KQL 37, Sigma 31). Rule content is available to Blue tier accounts and above; this page shows counts only.

95 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Sub-techniques

- [T1114.001 Local Email Collection](https://intel.threadlinqs.com/technique/T1114.001) — 13 tracked threats
- [T1114.002 Remote Email Collection](https://intel.threadlinqs.com/technique/T1114.002) — 46 tracked threats
- [T1114.003 Email Forwarding Rule](https://intel.threadlinqs.com/technique/T1114.003) — 15 tracked threats

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1114
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)