Operation BlueDash Phishing Campaign Deploys Dual RMM Tools

In the modern corporate ecosystem, unified communication tools such as Microsoft Teams have transitioned from optional workplace software into mission-critical infrastructure. However, as enterprise communications have migrated to these digital hubs, cyber adversaries have adjusted their vectors accordingly. A sophisticated, ongoing cyberattack campaign tracked as Operation BlueDash has gained significant traction by exploiting this exact trust model. By weaponizing fake meeting invites, deceptive document transfers, and realistic software update prompts, Operation BlueDash tricks enterprise personnel into downloading silent loaders that quietly compromise corporate endpoints. First documented by security researchers at ZeroBEC and active since early 2026, this campaign stands out not for custom zero-day exploits, but for its surgical social engineering and its aggressive abuse of legitimate Remote Monitoring and Management (RMM) utilities—specifically Level RMM, ConnectWise ScreenConnect, and Tactical RMM.

Rather than deploying noisy, custom-coded trojans that are quickly flagged by modern Endpoint Detection and Response (EDR) solutions, the threat actors behind Operation BlueDash leverage a dual-RMM strategy. By installing two or more fully signed, commercial remote management tools simultaneously, the campaign establishes resilient, persistent administrative control over compromised systems. If an IT department detects and removes one remote management client, the secondary background agent ensures uninterrupted access for the attackers. This strategy represents a significant escalation in “Living off the Land” (LotL) tactics, posing severe challenges for Security Operations Centers (SOCs) tasked with separating authorized administrative activity from malicious intrusion.

Anatomy of the Lure: Social Engineering and Counterfeit Storefronts

The initial vector of Operation BlueDash demonstrates a deep understanding of corporate workflows and human psychology. Attacks routinely begin with targeted spear-phishing messages sent to employees across corporate departments. The emails feature “secure document” lures, claiming that a critical file—such as a legal contract, financial review, or HR policy document—is too large to transmit via standard email attachments and must instead be retrieved through a secure Microsoft Teams shared link.

When an unsuspecting recipient clicks the link embedded in the message, the traffic is routed through compromised web infrastructure to mask the final destination from basic URL filters. The victim is ultimately redirected to a fake Microsoft Store landing page hosted on malicious domains, most notably teamvem[.]com. The threat actors go to great lengths to maximize the authenticity of this counterfeit landing page, integrating official Microsoft branding, high-resolution product screenshots, official typography, and fake Windows taskbar visual elements.

Upon reaching the page, the user is presented with a prompt stating that their local Microsoft Teams client is outdated and must be updated before the shared secure document can be decrypted or viewed. This creates a false sense of necessity, coaxing the user into authorizing the software download without consulting their internal IT support team.

Technical Deep-Dive: Execution Flow and Silent Payload Delivery

The technical mechanics of the attack chain reveal a lightweight yet highly effective loader pipeline designed to minimize on-disk footprints and bypass security controls. Clicking the “Update” button on the fake storefront triggers the download of an executable file named supportdev.exe.

Static and dynamic analysis of supportdev.exe reveals that it is compiled using the legitimate Inno Setup installer builder. Instead of unpacking Microsoft Teams installation files, the executable serves purely as a delivery vehicle for malicious background scripting. Upon execution, supportdev.exe silently initiates a hidden PowerShell window using flags designed to suppress command execution visuals from the user’s desktop view (e.g., -WindowStyle Hidden).

Once activated, the background PowerShell script executes a sequence of automated retrieval and installation commands:

• Installer Retrieval: PowerShell reaches out to external infrastructure, including attacker-controlled cloud repositories and domain endpoints, to download official, legitimately signed installers for commercial RMM tools.
• Silent Account Registration: The script executes the Level RMM installer with hardcoded enrollment parameters, injecting an attacker-controlled API secret key (specifically identified in telemetry as LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D). This automatically registers the compromised host directly into the threat actor’s central Level RMM dashboard.
• Parallel Payload Execution: In tandem with the Level RMM deployment, the script fetches and silently installs ConnectWise ScreenConnect in the background. In secondary variants observed during parallel Zoom-themed phishing lures, the script deploys Tactical RMM or MeshAgent.

Because these installer binaries are signed by valid corporate digital certificates, endpoint security solutions routinely classify them as benign administrative applications. The installation completes without raising security alerts or prompting the user for elevated permissions beyond what standard installers invoke.

Inside Operation BlueDash: Dual-RMM Architecture and Unbroken Persistence

The defining technical signature of Operation BlueDash is its explicit reliance on a dual-RMM deployment architecture. Installing multiple remote monitoring tools on a single target machine is a calculated maneuver designed to counter corporate incident response workflows.

In standard threat containment scenarios, if a network administrator notices an unauthorized ScreenConnect or Level RMM instance running on an endpoint, the typical response is to isolate the host, uninstall the suspicious application, or block its specific C2 server domain. However, because Operation BlueDash drops two independent RMM platforms with distinct network infrastructures and registration keys, removing one client leaves the secondary channel entirely operational.

This structural redundancy grants the threat actors guaranteed, persistent interactive access. The abuse of legitimate management software provides several operational advantages to the adversary:

1. Bypassing Signature-Based AV: Standard antivirus solutions do not flag signed RMM executables because these utilities are widely used by legitimate managed service providers (MSPs) and enterprise IT helpdesks.
2. Encrypted C2 Channel: RMM platforms route traffic through legitimate cloud endpoints using standard TLS encryption, rendering network-level content inspection ineffective without deep SSL decryption.
3. Native Administrative Power: Once enrolled, the RMM agent provides the attackers with full remote desktop capabilities, background command-prompt access, direct file transfer functionality, and system service control without writing custom malware to disk.

Threat Actor Profile and Infrastructure Analysis

Threat intelligence teams investigating Operation BlueDash have attributed the campaign with moderate-to-high confidence to a threat actor group operating out of Nigeria. This attribution is backed by historical code analysis, domain registration telemetry, and operational overlap with previously identified West African threat groups specializing in enterprise access brokering and business email compromise (BEC).

An examination of the operational infrastructure highlights a multi-tiered architecture utilizing both compromised legitimate websites and attacker-registered web resources. Key infrastructure indicators tied to the campaign include:

• Phishing Landing Pages: Spoofed domain resources such as teamvem[.]com built to replicate Microsoft software stores.
• Payload Delivery Staging: Attacker-managed infrastructure including support[.]berrydev[.]xyz and corychase[.]org used to host secondary binaries and configuration scripts.
• Code Repositories: Developer platforms such as GitHub pages (including berry4603.github[.]io) leveraged to store obfuscated installation scripts and maintain operational persistence.

Research indicates that the threat actors continuously rotate workplace lures—shifting from Microsoft Teams updates to Zoom meeting invites or fake document shares—while maintaining the same fundamental objective: securing long-term, unmonitored access to high-value enterprise networks.

Post-Exploitation Reconnaissance and Network Expansion

Establishing persistent RMM access is rarely the final objective for the operators of Operation BlueDash. Once remote desktop or terminal connectivity is stabilized on an endpoint, the actors enter an intensive post-exploitation reconnaissance phase.

Using the command execution capabilities of the installed RMM tools, the actors query native Windows utilities to build a comprehensive map of the compromised machine and its surrounding corporate network. Key post-exploitation activities include:

• Security Control Auditing: Checking active Windows Defender settings, third-party EDR service statuses, host firewall rules, and BitLocker drive encryption configurations.
• Domain & Identity Mapping: Querying Active Directory environment details, domain controller roles, current logged-in users, and local administrator account structures using commands like net group "Domain Admins" /domain.
• Credential Mining: Attempting to extract saved browser credentials, cached domain tokens, and LSASS memory contents to facilitate lateral movement across internal subnets.

Depending on the strategic value of the victim organization, the access obtained through Operation BlueDash can be monetized directly via data exfiltration or sold on dark web access marketplaces to secondary threat groups, including ransomware affiliates.

Indicators of Compromise and Defensive Countermeasures

Defending against campaigns that exploit legitimate software requires a shift from simple signature matching to strict behavioral monitoring and application governance. Security teams should operationalize the following technical indicators and defensive strategies to mitigate the risks associated with Operation BlueDash.

Key Technical Indicators (IoCs)

• Counterfeit Domains & Infrastructure: teamvem[.]com, support[.]berrydev[.]xyz, corychase[.]org, berry4603.github[.]io
• Primary Loader Executable: supportdev.exe (Inno Setup Installer)
• Hardcoded Parameter Secret: LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D
• Identified RMM Binaries: Level RMM, ConnectWise ScreenConnect, Tactical RMM

MITRE ATT&CK Mapping

• T1566.001 (Phishing: Spearphishing Attachment/Link): Initial delivery via fake document lures leading to spoofed Microsoft update pages.
• T1059.001 (Command and Scripting Interpreter: PowerShell): Silent background execution of payload download commands.
• T1219 (Remote Access Software): Abuse of legitimate RMM utilities (Level RMM, ScreenConnect) to establish persistent C2.
• T1078 (Valid Accounts): Abuse of local administrative context to maintain long-term system control.

Enterprise Mitigation Recommendations

1. Implement RMM Software Application Controls: Restrict the execution of unauthorized remote management applications. Utilize Windows Defender Application Control (WDAC) or AppLocker policies to block unapproved RMM binaries across all non-IT endpoints.
2. Monitor Scripting Engine Lineage: Configure EDR behavioral detection rules to flag instances where setup installers (such as Inno Setup components) or web browsers spawn child processes like powershell.exe or cmd.exe with hidden flags.
3. Audit Unauthorized RMM Telemetry: Maintain a centralized inventory of authorized remote management tools within the enterprise. Configure network monitoring to trigger alerts whenever unapproved RMM client connections (e.g., unexpected Level RMM or ScreenConnect agent traffic) attempt outbound connections.
4. Enforce Enclosure of Application Updates: Instruct users that productivity tools like Microsoft Teams automatically manage their updates natively within the desktop application or through internal IT deployment tools (e.g., Microsoft Intune), and will never require manual browser downloads from external websites.