Actor Profile

Operation BlueDash is a phishing campaign attributed with moderate-to-high confidence to a threat actor group operating from Nigeria. The attribution is based on analysis of infrastructure, code history, and a GitHub environment used to operate the campaigns. The actor demonstrates operational sophistication through multi-brand phishing schemes, maintaining core infrastructure while rotating workplace application lures (Microsoft Teams, Zoom), payload hosts, and remote management platforms. Active since at least February 2026 based on GitHub repository commit history.

TTPs (Tactics, Techniques, Procedures)

The campaign employs social engineering via phishing emails with "secure document" lures themed around Microsoft Teams updates. Victims are directed through compromised web infrastructure to counterfeit Microsoft Store pages (teamvem[.]com). The attack chain uses an Inno Setup-based loader (supportdev.exe) that launches PowerShell in hidden windows to fetch and deploy legitimate RMM tools (Level RMM, ConnectWise ScreenConnect, Tactical RMM). Post-compromise activity includes system reconnaissance commands to check reboot status, system volume protection, firewall profiles, and local Administrator group enumeration. The deployment of multiple RMM tools establishes redundant access for persistence. Key techniques align with T1566 (Phishing), T1059.001 (PowerShell), T1219 (Remote Access Software), T1027 (Obfuscated Files), T1082 (System Information Discovery), and T1087.001 (Local Account Discovery).

Targets & Patterns

The campaign employs broad targeting through phishing emails, with no specific sector or geographic focus identified. The use of workplace collaboration tool lures (Microsoft Teams, Zoom) suggests targeting of corporate environments where these platforms are commonly used. The multi-brand approach indicates opportunistic targeting designed to maximize victim reach across organizations using different communication platforms. The parallel JIVS PhishKit campaign demonstrates coordinated mailbox credential-harvesting targeting multiple users within the same organization, suggesting an interest in corporate email access and potential lateral movement opportunities.

Historical Context

Operation BlueDash represents a continuation of RMM tool abuse trends observed throughout 2026. Earlier in 2026, Microsoft warned of multiple phishing campaigns using workplace meeting lures and PDF attachments to distribute signed malware (TrustConnect) as a conduit for ScreenConnect, Tactical RMM, and MeshAgent. ZeroBEC documented a similar campaign in May 2026 involving phishing emails with secure document lures that stealthily dropped RMM backdoors. The GitHub repository evidence indicates BlueDash has been active since at least February 2026. The actor's infrastructure reveals a second repository (rustovni) hosting Zoom meeting lures with Tactical RMM payloads, demonstrating evolution and expansion of the multi-brand scheme over time.

Defensive Recommendations

  • Monitor for PowerShell execution (T1059.001) launched from unexpected parent processes, particularly Inno Setup installers or executables downloaded from web browsers, using Sysmon Event ID 1 and command-line logging
  • Implement application allowlisting to restrict unauthorized RMM tool installations (Level RMM, ScreenConnect, Tactical RMM, MeshAgent) and alert on RMM agent registrations originating outside approved IT workflows
  • Block access to known malicious infrastructure including teamvem[.]com, support[.]berrydev[.]xyz, berry4603.github[.]io, and corychase[.]org at the network perimeter and DNS level
  • Deploy email security controls to detect and quarantine phishing messages with workplace collaboration tool themes (Teams, Zoom) that include external links to fake update or document-sharing pages
  • Establish behavioral detection for reconnaissance command sequences executed through RMM contexts, including checks for pending reboots, system volume protection status, firewall profile enumeration, and local Administrator group queries (T1082, T1087.001)