srl
IMAP
The Internet Message Access Protocol (IMAP) works on TCP port 143 (unencrypted) and 993 (implicit TLS). Unlike POP3, IMAP allows online management of email directly on the server and supports folder structures — which makes a compromised IMAP account a live-intelligence source, not just a static mailbox dump.
2025–2026 context: IMAP is no longer just a mail-retrieval protocol — it is the persistence mechanism of choice for advanced adversaries. The 2026 Zimbra espionage campaigns (Laundry Bear, Ulej) used IMAP as a covert, MFA-bypassing persistence channel: after gaining webmail access, they enabled IMAP on the mailbox and created application-specific passwords, allowing continued mailbox access outside the browser session and outside MFA. On the server side, Dovecot, Cyrus, and Courier produced a steady stream of authentication-bypass, memory-disclosure, and command-injection CVEs throughout 2025–2026.