aol.pm

Remote Email Collection

Subtechnique · ATTACK:enterprise:T1114.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1114.002",
  "title": "Remote Email Collection",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1114/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b4694861-542c-48ea-9eb1-10d356e7140a",
  "external_id": "T1114.002",
  "domain": "enterprise",
  "created": "2020-02-19T18:52:24.547Z",
  "modified": "2026-09-09T18:44:33.117Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Cybersecurity Advisory GRU Brute Force Campaign July 2021",
      "url": "https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--021885d8-90a5-4d70-91de-869783cd57d3

NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021

ATTACK:enterprise:S0413 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03a65a95-b802-49ee-bec1-a65cccec0e89

GitHub MailSniper

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1980e913-a4dc-415c-a98d-df1a20e001f2

Volexity SolarWinds · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ba59a68-1883-492d-8cd8-f22656eb58a4

DOJ GRU Indictment Jul 2018 · Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--328bd3eb-77a0-476d-bcf7-6cf5b21ed724

DOJ FBI Handala Hack March 2026

ATTACK:enterprise:G1033 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38961818-2eae-4f78-860b-9995dec10829

CISA Star Blizzard Advisory December 2023

ATTACK:enterprise:T1114.002 → subtechnique-of → ATTACK:enterprise:T1114

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a837390-7974-44e0-9d60-4c9831b8e272

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4eb5fba5-be97-4103-9b52-f77e02765fad

Mandiant APT1

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fdff650-7872-4991-9667-bbe9f88f8085

CISA Iran Albanian Attacks September 2022

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c42fa31-80df-4d67-92d2-4273c22a4d5b

ESET LightNeuron May 2019

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ee0cf67-d033-4620-b0c6-29b7a7d6592d

Mandiant APT29 Microsoft 365 2022 · Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76333b56-47b1-40c6-9223-c4cf6673362f

Symantec Seaduke 2015

ATTACK:enterprise:M1060 → mitigates → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7877810d-3995-43ba-aa44-a9d4f9f85a57

TrustedSec OOB Communications

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8178dba2-1469-4322-af59-f6935152deb0

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--854e11fd-f29e-4b7e-a3c2-f4c8c9ee302f

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--885c54ee-078a-4cc2-a2a1-c7376767b6b6

Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025 · Microsoft HAFNIUM March 2020

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99dfbbaa-5e58-4a03-9b94-fb6962681ce3

Cybereason Valak May 2020

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad278368-be64-497f-abc3-024ee8447ef8

DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c43ac3ee-be59-419e-8ea2-43c04923102f

NCC Group Chimera January 2021

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4f902df-4b79-4bf7-b4b3-5873a316795b

US-CERT TA18-074A

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cacf0064-7b22-4432-96a2-f4329cc21a78

CERT Polska

ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9267a72-00d7-438b-8c41-af72021e89d0

FireEye Hacking FIN4 Video Dec 2014 · FireEye Hacking FIN4 Dec 2014

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1f879a7-cd1e-4865-bc6a-9b42d36df62b

Symantec Leafminer July 2018

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc0baea6-7e98-4cc3-9462-7eee9564cad0

KISA Operation Muzabi

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.