Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Operation BlueDash is a phishing campaign leveraging fake Microsoft Teams and Zoom update lures to distribute legitimate remote monitoring and management (RMM) tools such as Level RMM and ScreenConnect. The attackers use counterfeit websites and malicious installers to establish persistent remote access on compromised systems. The campaign, attributed to a threat actor group based in Nigeria, employs redundant RMM deployments to ensure access resilience and conducts post-compromise reconnaissance to assess system state and privilege levels.

AI-extracted · verify before operational use