Zimbra IMAP Enabled via API

Elgonad .@elgonad

•updated Mar 20, 2026•0•40

Detects Zimbra SOAP API requests attempting to enable IMAP access by setting zimbraPrefImapEnabled. This is a known persistence technique used by threat actors (such as in Operation GhostMail) to silently enable mail protocols, bypassing the web UI to maintain access using stolen app-specific passwords.