Zimbra Mailbox Archive Export

Elgonad .@elgonad

•updated Mar 20, 2026•1•0•26

Detects access to the Zimbra mailbox export endpoint (/home/~/?fmt=tgz). This native Zimbra feature is actively abused by APT actors (such as in Operation GhostMail) to silently export emails without deploying custom collection tools.