H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Remote Email Collection

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.

25 recorded

Relationships

mapped-to
from Remote Services with Stolen Credentials
Technique
mitigates
from Encrypt Sensitive Information
Mitigation
mitigates
from Multi-factor Authentication
Mitigation
mitigates
from Out-of-Band Communications Channel
Mitigation
subtechnique-of
to Email Collection
Technique
uses
from 2025 Poland Wiper Attacks
Campaign
uses
from APT1
Group
uses
from APT28
Group
uses
from APT29
Group
uses
from Chimera
Group
uses
from Dragonfly
Group
uses
from FIN4
Group
uses
from HAFNIUM
Group
uses
from HomeLand Justice
Campaign
uses
from Ke3chang
Group
uses
from Kimsuky
Group
uses
from Leafminer
Group
uses
from LightNeuron
Malware
uses
from Magic Hound
Group
uses
from MailSniper
Tool
uses
from SeaDuke
Malware
uses
from SolarWinds Compromise
Campaign
uses
from Star Blizzard
Group
uses
from Valak
Malware
uses
from VOID MANTICORE
Group
1 external

References

mitre-attack
T1114.002
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance