Zimbra Webmail RCE: Archive Exploit to Mailbox Theft

The Zimbra mail server began behaving unusually during the early morning window. Something arrived that should not have, and the impact traces back to the moment it was accepted. Determine exactly what the initial delivery looked like.

The archive was not simply stored safely; it triggered something during content scanning. Locate the evidence that shows what was written to disk and where, and identify the full path of the file that ended up in the Zimbra web root.

A file sitting in the web root does nothing until someone connects to it. Identify the external IP address that first interacted with the newly planted file over HTTPS.

The actor used the webshell to run Zimbra's own administrative tooling against specific mailboxes. Map the mailbox export activity to its MITRE ATT&CK technique identifier.

After the mailbox exports ran, a large volume of data left the mail server. Determine the external IP address that received it.

The entire intrusion hinged on a single vulnerability in the way the mail server processed an inbound archive. Map that exploitation step to its MITRE ATT&CK technique.

The actor did not rely on re-exploiting the flaw each time they needed access. They left something behind that gave them a re-entry point on demand. Name the type of artifact that provided that persistent access.