Operation BlueDash: RMM Tools Deployed via Fake Teams Updates [Cybersecurity] (2026)

Operation BlueDash: A Multi-Faceted Phishing Campaign Targeting Remote Access Tools

The cybersecurity landscape is a complex web of threats, and phishing campaigns are a constant concern for organizations worldwide. The latest operation, dubbed Operation BlueDash, is a multi-faceted phishing campaign that leverages Microsoft Teams lures to deliver legitimate remote monitoring and management (RMM) tools, including Level RMM and ConnectWise ScreenConnect. This sophisticated attack chain highlights the evolving tactics of threat actors and the importance of staying vigilant.

A Multi-Tool Approach

What makes Operation BlueDash particularly intriguing is the deployment of multiple RMM tools on the same host. This strategy is a clear attempt to establish redundant access and improve resilience. By using different tools, threat actors can ensure that even if one RMM program is detected and removed, the other tools remain operational, providing persistent remote access.

The use of PowerShell to download and launch the RMM tools is a common tactic, as it allows for stealthy execution and the ability to fetch official installers. The registration of endpoints using attacker-controlled secrets further emphasizes the intent to maintain control over the compromised systems.

A History of RMM Tool Abuse

This is not the first time RMM tools have been abused by threat actors. Earlier this year, Microsoft warned of phishing campaigns using workplace meeting lures and PDF attachments to distribute signed malware, which then acted as a conduit for ScreenConnect and other RMM programs. The campaign, codenamed TrustConnect, demonstrated the ability of threat actors to exploit legitimate tools for malicious purposes.

The May 2026 campaign, attributed to a threat actor group operating from Nigeria, further highlights the persistence of these attacks. The use of phishing emails to share secure documents and the subsequent download of RMM backdoors showcases the adaptability of threat actors in crafting convincing lures.

A Multi-Brand Scheme

Operation BlueDash also suggests a multi-brand scheme, where the core attack chain remains intact while altering the workplace application lure, payload host, and remote management platform. This approach allows threat actors to adapt to different environments and targets, making it more challenging for defenders to detect and mitigate the attacks.

The Broader Context

The disclosure of Operation BlueDash comes amidst the takedown of the Kratos phishing-as-a-service kit by German authorities, which further emphasizes the ongoing battle against phishing campaigns. The Kratos kit, estimated to have earned over €300,000 since 2024, highlights the financial incentives driving these attacks.

As cybersecurity researchers and analysts, it is crucial to stay informed about these evolving threats. By understanding the tactics and techniques used by threat actors, we can better prepare our organizations and contribute to a safer digital environment. Operation BlueDash serves as a stark reminder of the importance of vigilance and the need for continuous improvement in cybersecurity practices.

In my opinion, the multi-tool approach and the multi-brand scheme employed by Operation BlueDash demonstrate the sophistication and adaptability of threat actors. As we continue to uncover these complex attack chains, it becomes increasingly clear that staying ahead of the curve requires a comprehensive and dynamic approach to cybersecurity.