Loading story…
Researchers reported that Operation BlueDash is using Microsoft Teams-themed phishing lures to trick users into installing legitimate remote monitoring and management (RMM) software, giving attackers persistent remote access while blending into normal enterprise administration. Victims are redirected through compromised infrastructure to a fake Microsoft Store page at teamvem[.]com, where an Inno Setup loader named supportdev.exe launches hidden PowerShell to retrieve and register Level RMM and, in some cases, ConnectWise ScreenConnect. Investigators linked the activity with moderate-to-high confidence to a Nigeria-based threat actor and identified supporting GitHub infrastructure, including the Bluedashltd repository and berry4603.github[.]io, indicating the campaign has been active since at least February 2026.
The campaign reflects a broader pattern in which adversaries abuse legitimate RMM tools because they provide powerful remote administration capabilities and can evade scrutiny in environments where such software is common. Security researchers have previously highlighted sustained abuse of tools such as NetSupport Manager, Atera, Remote Utilities, and Remcos, with groups including SCATTERED SPIDER using multiple RMM platforms for lateral movement and hands-on-keyboard operations. In the BlueDash activity, operators were also seen conducting host reconnaissance after access, and related infrastructure supported a parallel Zoom-themed lure chain delivering Tactical RMM, underscoring how attackers are using trusted remote-access software and multi-brand social engineering to maintain access and complicate detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers reported a phishing campaign dubbed Operation BlueDash that uses Microsoft Teams-themed secure-document lures and compromised infrastructure to direct victims to a fake Microsoft Store page at teamvem[.]com. The infection chain uses an Inno Setup loader named supportdev.exe to launch hidden PowerShell that installs Level RMM and sometimes ConnectWise ScreenConnect, while related infrastructure also showed a Zoom-themed lure delivering Tactical RMM.
ZeroBEC reported that infrastructure tied to Operation BlueDash, including GitHub assets such as the Bluedashltd repository and berry4603.github[.]io, indicates the campaign has been active since at least February 2026. The activity was attributed with moderate-to-high confidence to a Nigeria-based threat actor.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcezerobec.com
Open sourceredcanary.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026
Proofpoint reported a new **malware-as-a-service (MaaS)** offering that masquerades as a legitimate remote monitoring and management (RMM) product, branding itself as **TrustConnect** (delivered as “TrustConnect Agent”). Proofpoint assessed with *moderate confidence* that the actor behind TrustConnect was also a prominent user of **Redline stealer**, and said it worked with intelligence partners to disrupt parts of the malware’s infrastructure; the actor quickly showed resilience by standing up another fake RMM-themed site advertising a related malware variant called **DocConnect**. Proofpoint highlighted that attackers continue to favor RMM-style tooling for initial access and post-compromise control because it blends into normal enterprise remote support activity. Separately, Dark Reading summarized findings from Huntress’ 2026 Cyber Threat Report indicating a broad surge in **RMM abuse** as an intrusion strategy, citing a **277% year-over-year increase** in malicious RMM deployments and a corresponding decline in traditional malware usage. The report described RMM tooling as attractive to threat actors for stealth, persistence, and operational efficiency, and noted commonly abused products including **ConnectWise ScreenConnect**, **AnyDesk**, **Atera**, **NetSupport**, **PDQ Connect**, and **Splashtop**, with healthcare and technology seeing the largest increases. Together, the reporting underscores both the industrialization of RMM abuse and the emergence of purpose-built “fake RMM” malware offerings designed to look like enterprise remote support software.
Jun 29, 2026