T1114: T1114
Essential information
- MITRE technique ID
T1114- Confidence
- 100/100
- Revoked
- No
- Published
- 16/12/2025 19:37
- Modified
- 27/03/2026 01:08
- Author / Source
- The MITRE Corporation
Aliases
Email Collection
Platforms
windows macos linux Office Suite
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | collection |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (63)
-
The MITRE Corporation Confidence 100
[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Conti usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Storm-1747 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
UNC6040 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Venture Wolf usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SilverFox usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
AlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
MioLab usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures…
First seen 01/01/1970 · Last seen 16/11/5138 · -
MRxC0DER usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (111)
-
BCB usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Zagrebator.RAT usesFamily
-
Family
-
Infamouse Chisel uses
-
CraxsRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Rhadamanthys usesFamily
-
YTStealer usesFamily
-
AgentTesla usesFamily
-
RagnarLocker usesFamily
-
RemKos RAT usesFamily
-
Ntospy uses
-
PixyNetLoader usesFamily
Reports (50)
-
AlienVault Confidence 100 20 MITREs 3 IOCs 3 Observables
-
AlienVault Confidence 100 20 MITREs 2 Malwares 13 IOCs 6 Observables 1 APT
-
AlienVault Confidence 100 16 MITREs 14 IOCs 14 Observables
-
16 MITREs
-
AlienVault Confidence 100 1 CVE 20 MITREs 1 Malware 8 IOCs 8 Observables 1 APT
-
AlienVault Confidence 100 28 MITREs 5 IOCs 5 Observables
-
AlienVault Confidence 100 20 MITREs 7 IOCs 7 Observables 1 APT
-
20 MITREs 39 Observables
-
Threat landscape — insurance relatedConfidence 100 199 MITREs 11 APTs
-
10 MITREs 3 Malwares 1 APT
-
AlienVault Confidence 100 24 MITREs 2 Malwares 4 IOCs 4 Observables 1 APT
-
AlienVault Confidence 100 19 MITREs 6 Malwares 35 IOCs 35 Observables 1 APT
Vulnerabilities (CVE) (48)
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, …
- Attack vector
- Network
- Published
- 05/12/2025
- Modified
- 29/05/2026
targets
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.
- Published
- 03/11/2021
- Modified
- 29/05/2026
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, …
- Attack vector
- NETWORK
- Published
- 11/03/2025
- Modified
- 21/12/2025
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass in limited scenarios.This issue affects MOVEit Transfer: from …
- Attack vector
- NETWORK
- Published
- 25/06/2024
- Modified
- 21/12/2025
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway …
- Published
- 25/06/2025
- Modified
- 26/06/2025
A code injection vulnerability in the User Portal and Webadmin of Sophos Firewall allows for remote code execution.
- Attack vector
- Network
- Published
- 23/09/2022
- Modified
- 27/05/2026
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. …
- Attack vector
- NETWORK
- Published
- 18/10/2023
- Modified
- 21/12/2025
A privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.
- Published
- 10/01/2022
- Modified
- 20/12/2025
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could …
- Attack vector
- LOCAL
- Published
- 26/01/2026
- Modified
- 27/03/2026
Course Of Action (4)
-
Multi-factor Authentication mitigates
-
Out-of-Band Communications Channel mitigates
-
Encrypt Sensitive Information mitigates
-
Audit mitigates