Full Report
Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management (RMM) tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming that Microsoft Teams had to be updated before the shared document could be opened," ZeroBEC said in
Analysis Summary
# Incident Report: Operation BlueDash - Phishing via Counterfeit Microsoft Teams Updates
## Executive Summary
Operation BlueDash is a sophisticated phishing campaign attributed to a Nigerian threat group that utilizes Microsoft Teams and Zoom lures to distribute legitimate Remote Monitoring and Management (RMM) tools. By tricking users into installing a fake "Teams Update," the attackers deploy Level RMM and ScreenConnect to establish persistent, redundant access to victim environments. The campaign focuses on initial reconnaissance and privilege enumeration once access is secured.
## Incident Details
- **Discovery Date:** July 2026 (Reported by ZeroBEC)
- **Incident Date:** Active since at least February 2026
- **Affected Organization:** Approximately 80+ organizations (based on historical campaign data)
- **Sector:** Multi-sector (Workplace environments using Teams/Zoom)
- **Geography:** Global targets; Threat actor infrastructure linked to Nigeria
## Timeline of Events
### Initial Access
- **Date/Time:** February 2026 – Present
- **Vector:** Phishing emails containing "secure document" lures.
- **Details:** Victims are redirected through compromised web infrastructure to a counterfeit Microsoft Store page (`teamvem[.]com`) claiming an update is required to view a shared document.
### Lateral Movement
- **Details:** Following initial infection, actors use the installed RMM tools to execute PowerShell commands for host exploration. They enumerate local Administrator groups and measure firewall profiles to prepare for potential lateral movement or privilege escalation.
### Data Exfiltration/Impact
- **Impact:** Redundant remote access established via Level RMM, ScreenConnect, and Tactical RMM. Potential for full system compromise, data theft, and secondary malware deployment (e.g., ransomware) depending on the operator's next steps.
### Detection & Response
- **Detection:** Discovered by ZeroBEC researchers through analysis of "supportdev.exe" and associated GitHub repositories.
- **Response:** Public disclosure of Indicators of Compromise (IoCs) and behavioral patterns to alert defenders.
## Attack Methodology
- **Initial Access:** Phishing/Social Engineering (Fake Microsoft Store/Teams Update).
- **Persistence:** Deployment of redundant RMM agents (Level RMM, ScreenConnect, Tactical RMM) to ensure access remains if one tool is removed.
- **Privilege Escalation:** Enumeration of local Administrators group members.
- **Defense Evasion:** Use of legitimate, signed RMM tools (Living-off-the-Land/RMM abuse) and hidden PowerShell windows.
- **Credential Access:** Phishing for mailbox credentials (identified in related JIVS PhishKit campaigns).
- **Discovery:** Running commands to check system reboot status, volume encryption (BitLocker), and firewall profiles.
- **Lateral Movement:** Facilitated through RMM remote control capabilities.
- **Collection:** Host reconnaissance and "operator checklists" for system state.
- **Impact:** Remote command execution and persistent backdoor access.
## Impact Assessment
- **Financial:** Risk of secondary ransomware infection or business email compromise.
- **Data Breach:** Exposure of local administrative credentials and system configuration details.
- **Operational:** High; attackers gain persistent, full control over the compromised endpoint.
- **Reputational:** Damage to organizations whose web infrastructure was compromised to host phishing lures.
## Indicators of Compromise
### Network Indicators
- `teamvem[.]com` (Fake store)
- `support[.]berrydev[.]xyz` (Infrastructure)
- `berry4603[.]github[.]io` (Payload hosting)
- `GxSCHE8EZwfyYN3iPQHPai8D` (Level RMM API Key)
### File Indicators
- `supportdev.exe` (Inno Setup-based loader)
- `Tactical RMM` agent installers
### Behavioral Indicators
- PowerShell execution from unauthorized RMM contexts.
- Sudden installation of multiple RMM tools (ConnectWise/Level/Tactical) on a single host.
- Commands: `net localgroup administrators`, checking `fwupdmgr` or firewall profiles via CLI.
## Response Actions
- **Containment:** Revoke the specific RMM enrollment tokens and block associated domains at the firewall/web proxy level.
- **Eradication:** Identify and remove unauthorized RMM agents and associated Inno Setup loaders from endpoints.
- **Recovery:** Audit administrator group memberships and reset credentials for any highlighted privileged users.
## Lessons Learned
- **Redundancy as a Tactic:** Attackers are increasingly deploying multiple legitimate tools to avoid being "kicked out" by single-tool detection.
- **RMM Abuse:** Legitimate tools remain a primary vector for avoiding EDR/AV signature detection.
- **Identity Theft:** Phishing campaigns are evolving from simple credential theft to sophisticated software delivery chains.
## Recommendations
- **Application Whitelisting:** Implement AppLocker or similar policies to prevent the execution of unauthorized RMM tools (Level, ScreenConnect, etc.) except for approved IT staff.
- **DNS Filtering:** Block known malicious domains and newly registered domains (NRDs).
- **Security Awareness:** Train employees to never download "updates" from non-standard links or landing pages when attempting to view documents.
- **Behavioral Monitoring:** Configure EDR to alert on "Administrative Discovery" commands when executed by non-IT parent processes.