Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

1. Executive summary

A phishing campaign dubbed "Operation BlueDash" is targeting organisations with Microsoft Teams-themed "secure document" lures that redirect victims to a counterfeit Microsoft Store page (teamvem[.]com). The attack deploys legitimate remote monitoring and management (RMM) tools — Level RMM and ConnectWise ScreenConnect — via an Inno Setup-based loader (supportdev.exe) to establish persistent, redundant remote access. Post-compromise, operators run a reconnaissance checklist to assess system state, firewall posture, and local administrator membership before deciding on next actions. Attribution to a Nigeria-based threat actor group is made with moderate-to-high confidence by a single source (ZeroBEC); no MITRE ATT&CK profile exists for "Operation BlueDash," so attribution must be treated as unconfirmed. EMEA financial services should treat unauthorised RMM deployments as high-priority incidents given the potential for follow-on fraud, data access, and lateral movement.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: "Operation BlueDash" is a campaign name assigned by ZeroBEC. The actor has no MITRE ATT&CK profile in the verified reference data. Attribution to a Nigeria-based group rests on a single source (ZeroBEC) assessing with moderate-to-high confidence based on infrastructure analysis, code history, and a GitHub environment. Treat attribution as unconfirmed.

Attack chain (confirmed from source)

1. Initial access — phishing email: Victim receives a phishing email purporting to share a "secure document." The email contains a link directing the victim through compromised web infrastructure.
2. Redirect — counterfeit Microsoft Store page: The victim lands on teamvem[.]com, a fake Microsoft Store page claiming Microsoft Teams must be updated before the shared document can be opened.
3. Payload delivery — Inno Setup loader: The victim downloads supportdev.exe, an Inno Setup-based loader. Execution launches PowerShell in a hidden window.
4. RMM deployment — Level RMM: The PowerShell command fetches an official Level RMM installer and registers the endpoint using an attacker-controlled enrollment secret: LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D.
5. RMM deployment — ScreenConnect (parallel): The same PowerShell command downloads and installs ConnectWise ScreenConnect in parallel, establishing redundant remote access channels.
6. Post-compromise reconnaissance: Operators execute commands to: - Determine if the system is pending a reboot. - Check whether the system volume is protected (encryption posture). - Measure active firewall profiles. - Enumerate members of the local Administrators group. - Identify the local Administrators group name.
7. Persistence: Both RMM tools provide persistent remote access. The deployment of multiple tools on the same host is a deliberate resilience tactic — if one is detected and removed, the other retains access.

Secondary campaign — Zoom lure (same actor infrastructure)

A second GitHub repository (rustovni) tied to the same account hosts a Zoom meeting lure with its own payload-delivery components. This variant downloads the Tactical RMM agent from its official GitHub release, installs it in the Windows temporary directory, and registers the compromised host using an embedded authentication token. This indicates a multi-brand scheme: the core attack chain remains intact while the lure application, payload host, and RMM platform are swapped.

Infrastructure and campaign history

• support[.]berrydev[.]xyz — threat actor infrastructure used for payload hosting.
• berry4603.github[.]io — GitHub Pages domain tied to the actor.
• GitHub repository Bluedashltd — contains phishing source, CNAME configuration, and SupportDev payload. Created February 2026, indicating campaign activity since at least that date.
• GitHub repository rustovni — contains Zoom lure and Tactical RMM delivery components.

Confidence caveat: All technical details above are sourced from a single vendor report (ZeroBEC via The Hacker News). No independent corroboration is available. Verify IOCs before enforcement.

4. Mitigation & containment

P1 — within 24 hours

• Block known infrastructure at network perimeter and DNS resolver:
• teamvem[.]com
• support[.]berrydev[.]xyz
• berry4603.github[.]io
• Hunt for RMM tool enrolment with unauthorised keys:
• Search EDR telemetry and endpoint logs for processes named supportdev.exe.
• Search for the string LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D in process command lines, scripts, and configuration files.
• Identify any endpoints running Level RMM, ScreenConnect, or Tactical RMM that are not in the approved IT asset management inventory.
• Isolate and investigate any host with unauthorised RMM: If an unauthorised RMM installation is confirmed, isolate the host from the network immediately. Collect volatile artefacts (memory, running processes, scheduled tasks, registry Run keys, services) before reimaging.
• Review RMM tool enrolment controls: If Level RMM, ScreenConnect, or Tactical RMM are legitimate tools in the environment, audit all enrolled endpoints against the approved inventory and revoke any unrecognised enrolment keys or tokens.

P2 — within 72 hours

• Deploy EDR detection rules for the behavioural pattern described in §6 (unrecognised RMM process spawning reconnaissance commands).
• Application allow-listing / blocklist: If the organisation does not use Level RMM, ScreenConnect, or Tactical RMM, block these executables by hash/signature at the endpoint. If they are used legitimately, restrict execution to approved paths and service accounts only.
• Email security review: Search mail logs for Teams-themed "secure document" lures and any links resolving to teamvem[.]com or support[.]berrydev[.]xyz. Identify and remediate recipients who clicked.
• GitHub reconnaissance: Check whether berry4603 or repositories Bluedashltd and rustovni appear in any proxy logs, DNS logs, or developer workstation activity.

P3 — within 7 days

• User awareness: Brief staff on the fake Microsoft Store / Teams update lure pattern. Reinforce that legitimate application updates do not originate from arbitrary domains during document access.
• Process control — RMM governance: Establish or review a policy requiring all RMM tool installations to be tied to a change-management ticket and verified against an asset inventory. Monitor for RMM binaries appearing in C:\Windows\Temp\ or user temp directories.
• Threat hunt: Search historical logs (since February 2026) for the indicators in §5 and the behavioural pattern of RMM processes spawning net localgroup administrators, Get-LocalGroupMember, firewall profile enumeration, or reboot-pending checks.

5. Indicators of compromise

domain  teamvem[.]com
domain  support[.]berrydev[.]xyz
domain  berry4603.github[.]io
filename  supportdev.exe
enrollment_key  LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D
github_repo  Bluedashltd
github_repo  rustovni
github_account  berry4603

Behavioural indicators

6. Detection

rule Operation_BlueDash_SupportDev_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-27"
    reference = "https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html"
    description = "Detects Inno Setup-based loader supportdev.exe used in Operation BlueDash"
  strings:
    $loader_name = "supportdev.exe" nocase
    $api_key = "LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D" nocase
    $infra1 = "teamvem.com" nocase
    $infra2 = "support.berrydev.xyz" nocase
    $infra3 = "berry4603.github.io" nocase
  condition:
    2 of them
}

title: Operation BlueDash - RMM Process Spawning System Reconnaissance Commands
id: 7a3c1f2e-4b5d-4a8e-9c1f-0d6e7a8b9c2d
status: experimental
description: Detects legitimate RMM tools (Level RMM, ScreenConnect, Tactical RMM) spawning reconnaissance commands characteristic of Operation BlueDash post-compromise activity
references:

  - https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html
author: Adverse Trace
date: 2026/07/27
tags:

  - attack.discovery
  - attack.t1087
  - attack.t1016
logsource:
  product: windows
  category: process_creation
detection:
  selection_rmm_parent:
    ParentImage|contains:

      - 'level'
      - 'ScreenConnect'
      - 'tactical'
  selection_recon_commands:
    CommandLine|contains:

      - 'net localgroup administrators'
      - 'Get-LocalGroupMember'
      - 'Get-NetFirewallProfile'
      - 'pending reboot'
      - 'system volume'
  condition: selection_rmm_parent and selection_recon_commands
falsepositives:

  - Legitimate IT administrator activity using approved RMM tools for system checks
level: high

title: Operation BlueDash - Hidden PowerShell from Inno Setup Loader
id: 8b4d2g3f-5c6e-4b9f-0d2g-1e7f8b9c0d3e
status: experimental
description: Detects PowerShell launched in a hidden window from supportdev.exe, consistent with Operation BlueDash payload delivery
references:

  - https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html
author: Adverse Trace
date: 2026/07/27
tags:

  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:

      - 'supportdev.exe'
  selection_powershell:
    Image|endswith:

      - 'powershell.exe'
      - 'pwsh.exe'
  selection_hidden:
    CommandLine|contains:

      - '-WindowStyle Hidden'
      - '-w hidden'
  condition: selection_parent and selection_powershell and selection_hidden
falsepositives:

  - Unlikely
level: critical

7. Sources

• The Hacker News, "Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update," https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html, 2026-07-27

8. Adverse Trace position

Operation BlueDash represents a credible threat to EMEA financial services endpoints despite its unconfirmed attribution. The attack chain is technically unsophisticated — it abuses legitimate RMM tools rather than custom malware — but this is precisely what makes it effective: the tools are signed, widely used, and may evade default endpoint controls. The deployment of redundant RMM channels (Level RMM + ScreenConnect, or Tactical RMM in the Zoom variant) increases the likelihood of persistent access surviving partial remediation. The post-compromise reconnaissance checklist (firewall, encryption, admin group) suggests operators are assessing the environment for follow-on actions — potentially including data access or fraud enablement — though no data exfiltration or ransomware activity is described in the source. All technical detail is single-sourced (ZeroBEC via The Hacker News); clients should verify IOCs before enforcement. We will monitor for independent corroboration, additional IOCs, and any evidence of follow-on intrusion activity targeting financial services organisations.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.