Operation Blue Dash Deploys Level RMM and Screen Connect via Fake Teams Update
Summary: ZeroBEC reported a Microsoft Teams-themed phishing campaign, codenamed Operation BlueDash, that routes victims through compromised web infrastructure to a counterfeit Microsoft Store page at teamvem[.]com claiming Teams must be updated before a shared document opens. The download delivers supportdev.exe, an Inno Setup-based loader that launches PowerShell in a hidden window, fetches an official Level RMM installer, registers the endpoint with an attacker-controlled enrollment secret, and in parallel downloads and deploys ConnectWise ScreenConnect. ZeroBEC attributed the campaign with moderate-to-high confidence to a threat actor group operating from Nigeria, based on infrastructure, code history, and a GitHub environment, and found a repository named Bluedashltd whose commit history shows activity since at least February 2026.
What's compelling: The operators drop multiple RMM tools on the same host for redundant access, so removing one detected tool may leave another in place, and their follow-on commands enumerate local Administrators group members and check firewall and encryption posture through an unauthorized RMM context rather than an approved IT workflow.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026