# Operation BlueDash: When Legitimate RMM Becomes the Backdoor, and a Public GitHub Repo Tells the Whole Story ## Summary There is no malware in this campaign. The final payload the victim receives is **the official Level RMM installer, downloaded directly from Level's own infrastructure**, installed via `msiexec` with a single command-line parameter. That parameter is an attacker-controlled enrollment key, and it automatically registers the endpoint into their RMM environment — the victim approves no connection, sees no RMM interface, and receives no prompt. ZeroBEC tracks this activity as **Operation BlueDash**, published 21 July 2026. The chain opens with an email claiming a document was too large to send directly and had therefore been shared securely through Microsoft Teams, routing through a compromised business website to a counterfeit Microsoft Store page demanding a Teams update before the document could be opened. But the most unusual thing about this report is not the attack chain. ZeroBEC reconstructed the campaign's **entire development history** — every infrastructure rotation, every added RMM, every loader generation — because the operators ran it from a public GitHub repository with a full commit history dating back to 6 February 2026. **Priority action: inventory which RMM tools are actually running in your environment and which are approved. Without that list, every detection measure downstream has nothing to anchor on.** * * * ## Why RMM Became the Payload of Choice Before the attack chain, BlueDash needs its context: this is not an isolated case but an expression of a measured trend. In the [2026 Threat Detection Report](https://redcanary.com/threat-detection-report/trends/rmm-tools/), Red Canary observed RMM tools appearing as the **ultimate payload** in an increasing number of campaigns, particularly web-based phishing. NetSupport Manager climbed from seventh to **fourth** on their top ten threat list. RMM tools are legitimate administrative utilities that managed service providers, security vendors and IT departments use to manage employee workstations remotely. They are readily available, often free, highly reliable and easy to use. Once an adversary installs one on a compromised system, they have a professional-grade administration platform — the command line, the desktop UI, and access to any file on the system. Red Canary lists three advantages RMM holds over traditional malware: * **Easy to use by design**, purpose-built for remote interaction. That is the product's function. * **No need to code anything yourself.** Things like persistence simply become a checkbox. * **They are signed**, letting them evade controls and alerts that expect malicious binaries to be unsigned. On top of that, traffic generated by many RMM tools flows through infrastructure and domains owned by the companies that develop them, which is unlikely to be flagged as suspicious and blends into routine network traffic. **The perception problem is the more worrying part.** Red Canary states it plainly: many SOCs consider unapproved RMM tools in their environment a symptom of "shadow IT" and only a minimal cause for concern. In practice, ransomware crews, state-funded adversaries and financially motivated threats of every variety routinely abuse them. If an adversary is lucky — or has done their homework — and picks an RMM the organisation already permits, detection becomes immensely more complicated. Even when they abuse an unpermitted tool, organisations are often slow to respond or reluctant to block it outright for fear of breaking a legitimate business use case. **The 16 RMM tools Red Canary detected being abused in 2025:** Action1, Chrome Remote Desktop, ConnectWise ScreenConnect, Datto/CentraStage, GoRelo, GotoHTTP, ITAgent, Itarian, **Level**, LogMeIn Resolve, N-Able N-Sight, NetSupport Manager, PDQ Connect, SimpleHelp, Syncro, Velociraptor. Some developers have pushed back: LogMeIn Resolve added installer logic that flags renamed RMM installers (a common hallmark of abuse), and ScreenConnect, PDQ and Velociraptor have taken steps of their own. But as Red Canary notes, **when a developer makes their particular tool harder to abuse, adversaries simply adopt a new one.** Operation BlueDash proves the point: it adds Level RMM to the known ecosystem. * * * ## Timeline Reconstructed From Commit History This is the most distinctive part of ZeroBEC's report. It is rare to get a campaign timeline built from the attacker's own git log. ![Campaign evolution chart](https://zerobec.com/blog/bluedash_evolution_chart.png align="center") *Key campaign changes reconstructed from the Teams and Zoom repository histories (source: ZeroBEC).* **Microsoft Teams branch — repository** `Bluedashltd` | Date | Repository change | Operational significance | | --- | --- | --- | | 6 Feb 2026 | Repository created with the fake Teams/Microsoft Store page and supporting images | First observed source-controlled deployment of the Teams lure | | 6 Feb 2026 | The Update action pointed directly to an attacker-controlled ScreenConnect client | Earliest observed RMM delivery path | | 6 Feb 2026 | `teamvem[.]com` added through the repository CNAME and GitHub Pages | Connected the phishing domain to the source repository | | 22 Mar 2026 | The ScreenConnect download endpoint was replaced | Infrastructure rotation while preserving the lure | | 27 May 2026 | Direct ScreenConnect delivery replaced by `supportdev.exe` | Introduced a multi-RMM loader (Level + ScreenConnect) | | 27 May 2026 | CNAME changed from `teamvem[.]com` to `support[.]berrydev[.]xyz` | Migrated the custom domain while the older site continued through Netlify | | 27 May 2026 | `supportdev.exe` moved into the primary repository | Consolidated phishing and payload delivery in one development environment | **Zoom branch — repository** `rustovni` | Date | Repository change | Operational significance | | --- | --- | --- | | 19 May 2026 | Repository created with `invite.html`, `install-guide.html`, `microsoft-store.html` and Zoom-themed assets | Parallel campaign using the same fake-update framework | | 19 May 2026 | `bsupport.exe` hosted through Dropbox and linked from the phishing pages | Used a legitimate cloud-storage service for payload delivery | | 19 May 2026 | `gustavodev[.]xyz` added as the GitHub Pages CNAME | Connected the Zoom lure to another attacker-controlled domain | | 21 May 2026 | `bsupport.exe` and `bsupport.zip` moved from Dropbox into GitHub hosting and releases | Rotated payload hosting while keeping the campaign operational | | 6 Jul 2026 | Older executables removed, `ZoomInstallerSetup.js` added | Shifted the branch to JScript-based Tactical RMM deployment | **External context** | Date | Event | | --- | --- | | 3 Mar 2026 | Microsoft Defender Security Research publishes its analysis of signed workplace-app impostors deploying ScreenConnect, Tactical RMM and MeshAgent | | May 2026 | ZeroBEC publishes a separate ScreenConnect campaign whose phishing emails passed DKIM, SPF and DMARC | | Sep 2025 | Red Canary and Zscaler publish joint research on multiple web-based phishing campaigns dropping ITarian, PDQ, SimpleHelp and Atera | | 21 Jul 2026 | ZeroBEC publishes Operation BlueDash | The timeline is more than a list of indicators. It exposes the operators' workflow: reuse the same visual framework, rotate custom domains and cloud services, replace RMM instances, **preserve older code during revisions**, and expand the number of remote-access mechanisms available after execution. * * * ## Kill Chain ![BlueDash attack chain](https://zerobec.com/blog/bluedash_attack_chain.png align="center") *The observed Operation BlueDash chain, from phishing email to multi-RMM access and operator reconnaissance (source: ZeroBEC).* 1. The victim receives a phishing email stating a document was too large to deliver directly and had been shared securely through Microsoft Teams. It asks the recipient to select "Access Your Secure Document" and recommends opening the file from a desktop or laptop. 2. The embedded link points to a path on a **compromised Turkish website**: `zerrinperde[.]com[.]tr/Microsoftteam/invite-teams`. 3. The landing page is a Microsoft Store clone reproducing the real design closely — Teams branding, product details, screenshots, and even **a fake Windows taskbar**. The user is told an update is required before the secure document can be accessed. 4. Clicking Update downloads `supportdev.exe` from `support[.]berrydev[.]xyz`. 5. `supportdev.exe` is an Inno Setup package that launches `powershell.exe` with `ExecutionPolicy Bypass` and `WindowStyle Hidden`. 6. PowerShell downloads the official Level RMM MSI **from Level's own infrastructure** into the user's temporary directory. 7. It invokes `msiexec.exe` with a quiet installation switch and the attacker-controlled enrollment parameter `LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D`. 8. The same PowerShell command downloads and executes a ScreenConnect client from `sqnchzmt4lsc[.]net`, creating a second remote-access channel. 9. The endpoint is automatically enrolled into the operators' Level RMM environment. 10. The operator connects interactively through the RMM channel and runs a reconnaissance sequence to assess the host. ![Counterfeit Microsoft Store page](https://zerobec.com/blog/bluedash_fake_store.png align="center") *The counterfeit Microsoft Store page presenting a Microsoft Teams update (source: ZeroBEC).* ### An Attacker Mistake Became an Investigative Lead By the time ZeroBEC began its analysis, the original phishing page was gone. They pivoted to historical URL intelligence and found another site hosting an identical lure: `anujyotindustries[.]com`. On that page, clicking Update opened an installation guide and initiated a file named `MicrosoftTeams_Update.exe`. But that file **was not a valid executable** — it contained the phishing page's own HTML, because the `installApp()` function pointed back to the page itself. ![The broken installApp function](https://zerobec.com/blog/bluedash_installapp_function.png align="center") *The* `installApp()` *function pointed the download to the phishing page rather than a payload (source: ZeroBEC).* That branch was likely disabled, misconfigured, under development, or stripped of its payload before analysis. It still exposed the campaign's page structure, filename conventions and JavaScript logic — and those became pivots for locating a functional deployment elsewhere. **How ZeroBEC found it is worth recording:** they used the phishing page's own title — "Microsoft Store - Microsoft Teams" — as a search pivot. That revealed `teamvem[.]com`, a live deployment with the same page design, social-engineering narrative and fake Microsoft Store workflow. DNS analysis showed the site was deployed through Netlify, exposing the hostname `bluedashlimited[.]netlify[.]app`. This is dorking simple enough to be overlooked, and it works precisely because the operators reuse the same visual framework across every campaign. * * * ## Technical Analysis ### SupportDev: Silent RMM Enrollment via a Command-Line Parameter ![Inno Setup metadata](https://zerobec.com/blog/bluedash_inno_setup_meta.png align="center") *Inno Setup metadata recovered during static analysis of* `supportdev.exe` *(source: ZeroBEC).* `supportdev.exe` is not a Microsoft Teams installer. It is an Inno Setup package designed to launch a hidden PowerShell command. Unpacking it exposes a short but operationally significant script that creates **two independent remote-access paths**. The crux is how Level RMM is installed. Supplying the enrollment parameter during installation **automatically registers the endpoint to the operators' Level RMM environment without requiring the victim to approve a connection or interact with the RMM interface**. And because the legitimate vendor installer is used, the operators inherit the full functionality and trust normally associated with an approved administrative product. This is the point that matters most defensively. There is nothing for static analysis to find: the MSI is genuine, the signature is Level's, the download host is `downloads[.]level[.]io`. The only malicious element in the entire transaction is **the value of a command-line parameter**. ### Redundancy Is the Design Goal, Not a By-Product The same PowerShell command downloads and executes a ScreenConnect client from `sqnchzmt4lsc[.]net`. The parallel use of Level RMM and ScreenConnect is central to the campaign's resilience. Removal or disruption of one product **does not necessarily eliminate the attacker's second remote-access channel**. The report supplies direct evidence that the design works: at the time of analysis, the ScreenConnect endpoint was no longer operational — but the Level path remained functional and continued to enroll test systems into the attacker-controlled RMM environment. Half the infrastructure was dead and the campaign was still running. For incident responders the implication is concrete: when you find an unauthorised RMM on a host, **the next question is "is there another one", not "is it removed yet".** ### The Operator's Reconnaissance Checklist ![Reconnaissance commands](https://zerobec.com/blog/bluedash_recon_commands.png align="center") *PowerShell commands the operators executed through the RMM channel to inspect the compromised endpoint (source: ZeroBEC).* ZeroBEC captured commands executed **after** the remote-management agent was installed. These were not required to complete the installation — they are follow-on assessment, and they demonstrate the operators were actively evaluating the system rather than running a purely automated install workflow. | Observed command | Likely objective | MITRE ATT&CK | | --- | --- | --- | | `Microsoft.Update.SystemInfo.RebootRequired` | Determine whether the host is awaiting a reboot and whether persistence or further installs might be disrupted | T1082 | | `Get-BitLockerVolume -MountPoint C:` and `KeyProtector` | Determine whether the system volume is protected and identify key-protector configuration | T1082 | | `Get-NetFirewallProfile -PolicyStore ActiveStore` | Measure enabled firewall profiles and evaluate host-network restrictions | T1518.001 | | `Get-LocalGroupMember` for SID `S-1-5-32-544` | Count or enumerate members of the local Administrators group | T1069.001 | | Resolve the localized name of SID `S-1-5-32-544` | Identify the local Administrators group name regardless of system language | T1069.001 | ZeroBEC assesses this sequence as a practical operator checklist: determine system state, understand encryption and firewall posture, identify privileged local users — then decide how to continue. **That last command is the detail I find most telling.** Resolving the localized name of SID `S-1-5-32-544` is not something you write for a single target. It is something you write when you already know your victims will be running Windows in a variety of languages. That is the signature of systematic multinational targeting, not an opportunistic hit. And as ZeroBEC points out, this is where the defensive opportunity sits: the commands originate through **an unauthorised RMM context** rather than an approved IT workflow. ### The Zoom Branch: JScript Replaces the Executable Loader ![Zoom repository](https://zerobec.com/blog/bluedash_zoom_repo.png align="center") *The repository hosting the Zoom meeting lure and payload-delivery components (source: ZeroBEC).* A second repository in the same development ecosystem exposed a Zoom-themed operation. Its design and workflow closely mirror the Teams branch: a meeting lure, an "out of date" message, a counterfeit Microsoft Store page, and a download presented as a legitimate software update. The later Zoom branch downloads `ZoomInstallerSetup.js`, which: * Attempts to relaunch itself with elevated privileges through the `runas` verb * Downloads the Tactical RMM agent **from its official GitHub release** * Installs it under the Windows temporary directory * Enrolls the device into attacker-controlled infrastructure using an embedded authentication token * Includes paths for both 64-bit and 32-bit installations * Starts the agent service, completing persistent remote access The script references `api[.]investrneent[.]com` as the Tactical RMM server. Worth noting: this is a **typosquat of "investment"**, using the letter pair `rn` to resemble an `m` at a glance. The same infrastructure cluster includes `rmm[.]investrneent[.]com` and `mesh[.]investrneent[.]com`. The Zoom campaign confirms Operation BlueDash was never tied to one brand, one payload, or one RMM product. The operators can preserve the social-engineering framework while changing the workplace application, the scripting language, the payload host and the remote-management platform. * * * ## What Makes BlueDash More Durable Than a Typical Campaign Operation BlueDash is significant because its strength does not come from a novel malware family. It comes from operational flexibility and the deliberate abuse of trusted administrative tooling. * **Redundant access.** SupportDev attempts to establish both Level RMM and ScreenConnect on the same endpoint. * **Legitimate binaries.** The operation retrieves official RMM installers, reducing reliance on custom malware and letting activity resemble normal administration. * **Independently rotating infrastructure.** ScreenConnect instances, custom domains, compromised websites, GitHub Pages, Netlify, Dropbox and GitHub-hosted payloads can each be replaced separately. * **Reusable lure framework.** The same fake Microsoft Store model supports Teams and Zoom narratives and adapts to other workplace brands. * **Source-controlled operations.** Repository history enables rapid changes, preserves prior delivery logic, and exposes a continuous development process. * **Interactive follow-on activity.** Operators use their RMM access to inspect endpoint security and privilege posture before deciding how to proceed. My own reading of this: **the campaign's strength comes from software engineering practice, not from malicious code.** This group runs phishing as a product — with a repository, versions, a dedicated branch per lure brand, and old code preserved through refactors, exactly as an ordinary development team would. Disrupting one URL or one RMM instance removes neither the remaining access path nor the next version of the delivery chain. ### On Attribution ZeroBEC attributes Operation BlueDash to a specific group of developers operating from Nigeria at **moderate-to-high confidence**, based on converging technical and OSINT evidence rather than the registration details of a single domain: continuity of repository control over months, direct campaign artifacts held in the repositories, overlap between the Teams and Zoom branches in development practice and infrastructure patterns, and independent identity pivots. They also state their confidence in tiers: **high** that the Teams and Zoom campaigns originate from the connected GitHub development ecosystem; **moderate-to-high** that the operation is attributable to the identified Nigeria-based developer group. ZeroBEC deliberately withholds individual account handles and personal identity details, and found no evidence the GitHub account was compromised or repurposed by an unrelated actor. That tiered presentation is worth borrowing for internal reporting: separate what you are sure of from what you infer, and state where the line falls. * * * ## Indicators of Compromise > All indicators are taken from [ZeroBEC's Operation BlueDash report](https://zerobec.com/blog/operation-bluedash-multi-rmm-workplace-phishing). Domains and URLs are defanged. Historical infrastructure may no longer be active. The Tactical RMM authentication token was redacted by ZeroBEC; the Level key is retained because it is a campaign indicator. **Domains and hosting infrastructure** ```plaintext zerrinperde[.]com[.]tr # compromised site used in the original Teams lure anujyotindustries[.]com # compromised site hosting an identical Teams/Store page teamvem[.]com # active Teams-themed phishing domain bluedashlimited[.]netlify[.]app # Netlify deployment of the Teams phishing page support[.]berrydev[.]xyz # GitHub Pages custom domain, hosts the SupportDev payload linux[.]berrydev[.]xyz # related domain in the same infrastructure cluster gustavodev[.]xyz # GitHub Pages custom domain for the Zoom campaign api[.]investrneent[.]com # attacker-controlled Tactical RMM API server rmm[.]investrneent[.]com # related Tactical RMM infrastructure mesh[.]investrneent[.]com # related Mesh/Tactical RMM infrastructure sqnchzmt4lsc[.]net # ScreenConnect client delivery infrastructure ``` **Payload URLs and enrollment key** ```plaintext hxxps://support[.]berrydev[.]xyz/supportdev[.]exe hxxps://downloads[.]level[.]io/level[.]msi # OFFICIAL Level RMM installer hxxps://sqnchzmt4lsc[.]net/Bin/ScreenConnect[.]ClientSetup[.]exe?e=Access&y=Guest hxxps://sympatico15[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]exe?e=Access&y=Guest hxxps://bgustavo[.]screenconnect[.]com/Bin/ScreenConnect[.]ClientSetup[.]exe?e=Access&y=Guest hxxps://www[.]dropbox[.]com/scl/fi/5ngkfh2iquoa6gm88bhhr/bsupport[.]exe?rlkey=...&dl=1 LEVEL_API_KEY=GxSCHE8EZwfyYN3iPQHPai8D # attacker-controlled Level RMM enrollment key ``` **File hashes (SHA-256)** ```plaintext 87fc194f7644a957706faa708f24fe366adee836183e4acc3cfb703059796766 supportdev.exe 528dc74c8cafafbda1cd0d73fac20b8f439138891367069a9b074e8b029b0241 bsupport.exe d6fc85f882af49191a83aaf5d27e06312762e3c5ee8034c5ab5b3743660556e7 bsupport.zip ecd52efea05171b5acc1d84e643c77c0db91bdf8eabd36fa44a745f789e9612c ZoomInstallerSetup.js (v1) aff8cff96ef17a45d15da185d4698d453a433c117ee59d78e058191115284341 ZoomInstallerSetup.js (v2) 4ee0d3004e986f99cb4e6ae3d2bae2cdd40e1383554f2f233e403d1826d59c24 ZoomInstallerSetup.js (v3) 8483a435344cf3a594623cef7373c57704db7a3d81d5593a35f5a74c2d880717 SupportCenterTest.exe 090344137429fd43b12cc5dda8c9e6ae8e64e6e1e89c3d355444c3d11616179e Workstation.exe a4d174069cc01d1ce501131e1a05fe7a96b272f7566ce613b98930c84f69c72a Level1.msi 592574c5590f39e38243dc75c212f4a2e524f5f88538a74c54445876ec437da7 supportcenterdev.exe 0c869c2d54bdac05b3e96ccaa5a73ef3f457d260bd618565ec5f02dda6927ceb ScreenConnect.ClientSetup.msi 6e337c305d0b0f181a3f50e2956a906037e23bceacfea3ce95c051c295b044d9 ScreenConnect.ClientSetup.exe ``` **Development infrastructure** ```plaintext hxxps://github[.]com/berry4603/Bluedashltd -> Teams phishing source, CNAME configuration, SupportDev loader, 14-commit history Commit e6b0d5d77c62542943ed980c544d29eba7c54e4b -> historical revision with direct ScreenConnect delivery and residual earlier loader code Repository: rustovni -> related Zoom campaign that evolved to JScript-based Tactical RMM delivery ``` **Filenames and on-host artifacts** ```plaintext supportdev.exe # Inno Setup loader (Teams branch) MicrosoftTeams_Update.exe # download filename on the broken branch bsupport.exe / bsupport.zip # Zoom branch loader (early stage) ZoomInstallerSetup.js # Zoom branch JScript loader (later stage) # Behaviour worth watching powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden spawned by an Inno Setup executable msiexec.exe with an enrollment key that does not match the organisation's tenant wscript.exe / cscript.exe running installer-named scripts from Downloads or temp Tactical RMM agent installed under the Windows temporary directory ``` **RMM tools to inventory (source: Red Canary, observed abused in 2025)** ```plaintext Action1 Level PDQ Connect Chrome Remote Desktop LogMeIn Resolve SimpleHelp ConnectWise ScreenConnect N-Able N-Sight Syncro Datto/CentraStage NetSupport Manager Velociraptor GoRelo Itarian GotoHTTP ITAgent ``` > The presence of any tool on this list **is not by itself malicious**. The list serves inventory and allowlist policy work, not blanket blocking. * * * ## MITRE ATT&CK Mapping | Tactic | Technique ID | Technique Name | Observed in campaign | | --- | --- | --- | --- | | Resource Development | T1584.006 | Compromise Infrastructure: Web Services | Compromised Turkish and Indian websites hosting lure pages | | Resource Development | T1608.001 | Stage Capabilities: Upload Malware | Payloads hosted on GitHub Pages, Netlify, Dropbox | | Initial Access | T1566.002 | Phishing: Spearphishing Link | Secure-document and meeting lures directing users to compromised or attacker-controlled sites | | Defense Evasion | T1036 | Masquerading | Pages and files impersonating Microsoft Teams, Zoom, Microsoft Store, software updates | | Execution | T1204.002 | User Execution: Malicious File | Victims instructed to download and run the purported workplace-app update | | Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | SupportDev launching hidden PowerShell to fetch and install RMM agents | | Execution | T1059.007 | JavaScript | `ZoomInstallerSetup.js` deploying Tactical RMM | | Execution | T1218.007 | System Binary Proxy Execution: Msiexec | Official Level MSI installed silently with an enrollment parameter | | Privilege Escalation | T1548.002 | Bypass User Account Control | JScript self-elevation via the `runas` verb | | Command and Control | T1105 | Ingress Tool Transfer | Loaders retrieving Level, ScreenConnect and Tactical RMM installers | | Command and Control | T1219 | Remote Access Software | Level RMM, ScreenConnect and Tactical RMM providing persistent remote control | | Persistence | T1543.003 | Create or Modify System Process: Windows Service | The Tactical RMM agent service is started | | Discovery | T1082 | System Information Discovery | Operators querying reboot status and BitLocker configuration | | Discovery | T1518.001 | Software Discovery: Security Software Discovery | Operators measuring enabled Windows Firewall profiles | | Discovery | T1069.001 | Permission Groups Discovery: Local Groups | Operators enumerating local Administrators group membership | * * * ## Assessment If one sentence should carry into the SOC from this campaign: **there is nothing to block.** Try listing what a signature-based system could do against the BlueDash chain. The Level MSI is genuine, downloaded from `downloads[.]level[.]io`, signed by Level. The Tactical RMM agent comes from its official GitHub release. The ScreenConnect client is a real client. `msiexec.exe` and `powershell.exe` are Microsoft binaries. The first website in the chain is a real business that was compromised, not a freshly registered domain. The only malicious element in the entire transaction is **the value of a command-line parameter** — and no static analysis tool distinguishes a legitimate API key from an attacker's. What remains is **context**. Who installed it? From where? Does it fall inside an approved IT workflow? This is exactly ZeroBEC's point about the detection opportunity: the reconnaissance commands originate from an unauthorised RMM context rather than a legitimate operational process. The commands themselves — checking BitLocker, reading firewall configuration, counting Administrators group members — are things a real administrator might do any day. **On the group's maturity.** What struck me reading the report was not the technique but the process. They have a repository, a commit history, a branch per lure brand, old code preserved through refactors, and scheduled infrastructure rotation. This is how a software development team works, applied to phishing. The direct consequence: their release cycle is considerably shorter than most organisations' blocklist update cycle. There is an irony worth noting too: it is precisely this professional operation on public GitHub that gave ZeroBEC a view into the campaign that ordinary endpoint telemetry could never provide. ### Relevance for Vietnam **The "unfamiliar RMM" signal is saturated in the Vietnamese environment.** Many domestic businesses outsource IT, and it is not unusual to have several providers at once for different areas — one for infrastructure, one for workstations, one for applications. The result is that "there is an unfamiliar remote-control tool on this machine" is **normal** for a great many organisations. When a signal saturates, it stops being a signal. This is why inventory has to precede detection: you cannot recognise the abnormal without a list of the normal. **Local administrator rights remain common.** Red Canary makes the point directly: environments where ordinary users hold local admin rights — and can therefore freely install RMM tools — make the problem considerably worse. In many Vietnamese enterprise environments this is still the default for operational reasons. **The Teams and Zoom lures land on real working habits.** "The document was too large so it was shared through Teams" and "your Zoom client is out of date, update before joining" are situations staff genuinely encounter. Worth noting for awareness training: most training content teaches users to check the sender domain and the link domain. Here the link points to **a real business website that was compromised** — checking the domain contributes nothing, and telling users to "watch for unfamiliar domains" is advice that does not apply to this exact scenario. **The first thing to do is not buy a tool but take an inventory.** Red Canary points to [Surveyor](https://github.com/redcanaryco/surveyor) — a free open-source tool with a ready-made definitions file for many RMM products — as a starting point for profiling what your environment is actually running. The results may show both legitimate users running tools outside the catalogue and genuinely malicious activity. * * * ## Recommendations * **Inventory first, detect second:** profile which RMM tools are actually running in the environment and build an approved list covering products, server domains, tenant identifiers, publisher certificates and valid enrollment keys. * **Block unapproved RMM with application control** (WDAC, AppLocker, or your EDR's application controls) rather than alerting only — this is the one measure that works when the binary is genuine and signed. * **Alert on** `msiexec` **carrying an RMM enrollment parameter** when that product is not approved or the key does not match your tenant; alert as well on hidden PowerShell spawned by an Inno Setup executable from Downloads or temp. * **When you find an unauthorised RMM, do not stop at the one you found:** isolate the host, remove **every** remote-access channel, rotate affected credentials, and review the actions performed through the RMM console — many RMM tools log their own activity. * **For approved RMM platforms:** require MFA, and monitor the creation of new agents, sites, API keys and unattended-access sessions. * **Adjust awareness training content:** treat "secure document", "meeting transcript" and "update required before continuing" narratives as a combined risk signal, and tell users plainly that a link to a real business website can still be a malicious link. * * * ## References * ZeroBEC — [Operation BlueDash: Multi-RMM Workplace Phishing](https://zerobec.com/blog/operation-bluedash-multi-rmm-workplace-phishing) (21 July 2026) — original report, including sample Microsoft Defender XDR hunting queries * The Hacker News — [Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update](https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html) (27 July 2026) * Red Canary — [Remote monitoring and management tools, Threat Detection Report 2026](https://redcanary.com/threat-detection-report/trends/rmm-tools/) * Red Canary & Zscaler — [Four phishing lures in campaigns dropping RMM tools](https://redcanary.com/blog/threat-intelligence/phishing-rmm-tools/) (September 2025) * Red Canary — [Remote control: Detecting RMM software and other remote admin tools](https://redcanary.com/blog/threat-detection/rmm-software/) * Microsoft Defender Security Research — [Signed malware impersonating workplace apps deploys RMM backdoors](https://www.microsoft.com/en-us/security/blog/2026/03/03/signed-malware-impersonating-workplace-apps-deploys-rmm-backdoors/) (3 March 2026) * ZeroBEC — [ScreenConnect phishing campaign passing DKIM, SPF and DMARC](https://zerobec.com/blog/screenconnect-phishing-dkim-spf-dmarc-passed) (May 2026) * Red Canary — [Surveyor: environment RMM profiling tool](https://github.com/redcanaryco/surveyor) * [LOLRMM](http://lolrmm.io) — a catalogue of RMM tools and how each one works * [Ransomware Tool Matrix — RMM Tools](https://github.com/BushidoUK/Ransomware-Tool-Matrix/blob/main/Tools/RMM-Tools.md) — RMM tools known to be abused by ransomware operators * MITRE ATT&CK — [T1219: Remote Access Software](https://attack.mitre.org/techniques/T1219/)