Zimbra is an email and collaboration platform commonly deployed as an internet-facing server appliance. A Lazarus Group intrusion targeting medical research and technology exploited known vulnerabilities in unpatched Zimbra devices, installed web shells and custom tools, tunneled through relays, and exfiltrated roughly 100 GB of data for intelligence collection.