A phishing campaign tracked as Operation BlueDash has been deploying legitimate remote monitoring and management tools on enterprise systems through counterfeit Microsoft Teams update pages and fake Zoom meeting invitations since at least February 2026. Researchers attribute the campaign to a Nigerian-based threat actor with moderate-to-high confidence, based on infrastructure tied to a GitHub account created that month.
Operation BlueDash’s Fake Microsoft Teams and Zoom Lure Infrastructure
Operation BlueDash’s primary lure directs victims to counterfeit Microsoft Store pages hosted at teamvem[.]com, which present a notification that Microsoft Teams requires an update. A parallel campaign variant uses fake Zoom meeting invitation pages to draw victims to attacker-controlled download pages. Both lures present the download as a routine software action — installing an update or joining a meeting — to reduce suspicion about what the downloaded file actually does.
The infrastructure behind BlueDash traces to support[.]berrydev[.]xyz, the GitHub account “berry4603,” and two repositories named “Bluedashltd” and “rustovni” that host phishing pages and payload components. The “Bluedashltd” repository was created in February 2026, placing the campaign’s start date at that point.
The supportdev.exe Inno Setup Loader and Level RMM Deployment Chain
When a victim downloads and runs the file from the fake Teams update page, they receive “supportdev.exe” — an Inno Setup installer that appears to perform a legitimate installation but executes hidden PowerShell commands in the background. Those PowerShell commands fetch the legitimate Level RMM agent installer and register the victim’s endpoint using attacker-controlled credentials, establishing persistent remote access through the Level RMM platform.
Beyond Level RMM, Operation BlueDash also deploys ConnectWise ScreenConnect. Secondary campaign variants add Tactical RMM as a third option. All three are commercially sold and widely deployed remote monitoring tools with legitimate uses in enterprise IT management. This is precisely what makes them effective for the campaign: because these tools are familiar and trusted in enterprise environments, their presence on a system is less likely to trigger immediate investigation than an unrecognized binary would.
Nigerian Attribution and the “Bluedashltd” GitHub Repository
The moderate-to-high confidence attribution to a Nigerian-based threat actor rests on analysis of the GitHub account “berry4603” and its connection to the repositories “Bluedashltd” and “rustovni,” which the campaign used openly for staging phishing pages and payload components. The campaign name derives from the “Bluedashltd” repository designation — the operators did not appear to make significant effort to obscure this staging infrastructure.
At moderate-to-high confidence, researchers have identified consistent infrastructure patterns and behavioral indicators sufficient to make regional attribution, but have not confirmed the individual identities behind the campaign. The Nigerian association follows a pattern of criminal groups from that region adopting RMM-based persistent access techniques that were previously associated primarily with ransomware affiliate networks.
Why Legitimate RMM Abuse Makes BlueDash Difficult to Detect at Endpoint and Network Layers
Deploying legitimate RMM tools is a deliberate evasion choice. Endpoint detection and response tools face a fundamental challenge when attackers use commercially sold and widely deployed software: the behavioral signals for Level RMM, ScreenConnect, and Tactical RMM in legitimate use and malicious use are nearly identical. The tools generate real network traffic to real vendor infrastructure, communicate using signed binaries, and perform the same remote access functions they perform in authorized IT contexts.
The initial payload delivery through an Inno Setup installer — itself a common and trusted packaging format for legitimate Windows software — reduces the likelihood of triggering file-based detection at the entry point. The hidden PowerShell execution that fetches and registers the RMM agent occurs after the installer runs, further separating the malicious activity from the initial download event.
Enterprise security teams can address RMM abuse by maintaining an authoritative inventory of approved RMM tools and alert rules for any RMM agent registration or outbound connection that does not match that inventory. An endpoint establishing a new registration with Level RMM, ConnectWise ScreenConnect, or Tactical RMM when those tools are not part of the organization’s approved toolset is a high-confidence indicator of a BlueDash-style compromise. Proactive identification of unauthorized RMM installations — through periodic endpoint audits or automated detection — gives organizations visibility into this attack vector without depending on the initial payload triggering traditional detection.
