Operation BlueDash: Detecting Fake Teams Updates Delivering Level RMM and ScreenConnect

In the evolving landscape of 2026 threat operations, attackers are increasingly bypassing traditional malware development in favor of "Living off Trusted Land" (LotTL). Security Arsenal is tracking Operation BlueDash, a sophisticated campaign identified by researchers at ZeroBEC that weaponizes user trust in Microsoft Teams infrastructure.

This campaign does not rely on zero-day exploits; instead, it uses high-fidelity social engineering to trick users into installing legitimate Remote Monitoring and Management (RMM) tools—specifically Level RMM and ScreenConnect (ConnectWise Control). By convincing the victim that a Microsoft Teams update is required to view a "secure document," attackers gain persistent, authorized access to the endpoint using signed binaries that often evade standard detection mechanisms. Defenders must immediately treat unsolicited software updates, particularly for collaboration tools, with extreme scrutiny.

Technical Analysis

Threat Actor Campaign: Operation BlueDash Primary Vector: Social Engineering / Phishing Delivery Mechanism: Compromised web infrastructure redirecting to a counterfeit Microsoft Store page. Payload: Legitimate RMM software (Level RMM, ScreenConnect)

Attack Chain Breakdown

Initial Lure: The victim receives a phishing notification or email directing them to a "secure document."
Infrastructure Pivot: The link routes through compromised web infrastructure to a spoofed Microsoft Store page.
Social Hook: The page claims that Microsoft Teams must be updated before the document can be accessed.
Payload Delivery: Executing the "update" actually installs a legitimate RMM agent (Level or ScreenConnect).
Establishment: Attackers use the installed RMM tool to establish interactive sessions, move laterally, and deploy additional payloads.

Exploitation Status

Active Exploitation: Confirmed in the wild.
Evasion: The use of legitimate, digitally signed RMM tools allows the attacker to bypass application allow-listing that trusts common software vendors. Furthermore, RMM tools are designed to bypass firewall restrictions for remote access, making them ideal for C2 (Command and Control).

Detection & Response

Detecting Operation BlueDash requires identifying the unauthorized installation and execution of specific RMM binaries, particularly when spawned from unusual parent processes like web browsers.

YAML

---
title: Potential Operation BlueDash - RMM Installation via Browser
id: 8f4a2b1c-9d3e-4f5a-8b2c-1d3e4f5a6b7c
status: experimental
description: Detects the installation of Level RMM or ScreenConnect initiated by a browser, a common pattern in fake update scams.
references:
 - https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html
author: Security Arsenal
date: 2026/07/14
tags:
 - attack.initial_access
 - attack.t1189
logsource:
 category: process_creation
 product: windows
detection:
 selection_rmm:
   Image|contains:
     - 'Level'
     - 'ScreenConnect'
     - 'ConnectwiseControl'
   Image|endswith:
     - '.exe'
 selection_parent:
   ParentImage|endswith:
     - '\chrome.exe'
     - '\msedge.exe'
     - '\firefox.exe'
     - '\brave.exe'
 condition: all of selection_*
falsepositives:
 - Legitimate administrative installation of remote support tools by IT staff.
level: high
---
title: Suspicious Level RMM Agent Execution
id: a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of Level RMM agent binaries, which are often abused in this campaign.
references:
 - https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html
author: Security Arsenal
date: 2026/07/14
tags:
 - attack.execution
 - attack.t1059
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|contains:
     - '\Level.Agent.exe'
     - '\Level.Console.exe'
     - '\Level.Installer.exe'
 condition: selection
falsepositives:
 - Authorized use of Level RMM by the organization's IT department.
level: medium
---
title: Suspicious ScreenConnect Client Service Execution
id: b2c3d4e5-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects the execution of ScreenConnect client service binaries from user directories, indicating potential unauthorized access.
references:
 - https://thehackernews.com/2026/07/operation-bluedash-deploys-level-rmm.html
author: Security Arsenal
date: 2026/07/14
tags:
 - attack.persistence
 - attack.t1543
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|contains:
     - 'ScreenConnect.ClientSetup.exe'
     - 'ScreenConnect.WindowsClient.exe'
   Image|contains:
     - '\Users\'
     - '\AppData\'
 condition: selection
falsepositives:
 - Legitimate remote support sessions initiated by helpdesk.
level: high

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for RMM tools spawned by browsers or unusual parent processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName has_any ("Level", "ScreenConnect", "ConnectwiseControl")
| where ProcessVersionInfoCompanyName != "Microsoft Corporation" // Ensure we aren't flagging MS updates
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "explorer.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, SHA256
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for Level RMM and ScreenConnect binaries on disk and in memory
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username, 
  CreateTime
FROM pslist()
WHERE Name =~ "Level.*\.exe" 
   OR Name =~ "ScreenConnect.*\.exe" 
   OR Name =~ "ConnectwiseControl.*\.exe"

Remediation Script (PowerShell)

This script assists in identifying the presence of the RMM tools associated with Operation BlueDash.

PowerShell

<#
.SYNOPSIS
    Audit for Operation BlueDash RMM tools (Level RMM and ScreenConnect).
.DESCRIPTION
    This script scans common installation directories and running processes 
    for indicators of Level RMM or ScreenConnect installation. 
    Use this to audit endpoints if social engineering activity is suspected.
#>

Write-Host "[+] Starting Audit for Operation BlueDash RMM Tools..." -ForegroundColor Cyan

$ProcessesToCheck = @("Level.Agent", "Level.Console", "ScreenConnect.ClientService", "ScreenConnect.WindowsClient")
$PathsToCheck = @(
    "C:\Program Files\",
    "C:\Program Files (x86)\",
    "C:\Users\",
    "$env:LOCALAPPDATA\",
    "$env:TEMP\"
)

# Check Running Processes
Write-Host "[+] Checking running processes..." -ForegroundColor Yellow
$suspiciousProcs = Get-Process | Where-Object { $ProcessesToCheck -like ($_.ProcessName + "*") }

if ($suspiciousProcs) {
    Write-Host "[ALERT] Suspicious RMM processes found:" -ForegroundColor Red
    $suspiciousProcs | ForEach-Object { Write-Host " - PID: $($_.Id), Name: $($_.ProcessName), Path: $($_.Path)" -ForegroundColor Red }
} else {
    Write-Host "[OK] No suspicious processes currently running." -ForegroundColor Green
}

# Check File System for Installers/Binaries
Write-Host "[+] Checking file system for RMM artifacts..." -ForegroundColor Yellow
$foundFiles = @()

foreach ($path in $PathsToCheck) {
    if (Test-Path $path) {
        try {
            $files = Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | 
                    Where-Object { $_.Name -match "Level.*\.exe" -or $_.Name -match "ScreenConnect.*\.exe" -or $_.Name -match "Connectwise.*\.exe" }
            if ($files) { $foundFiles += $files }
        } catch {
            # Ignore access denied errors
        }
    }
}

if ($foundFiles) {
    Write-Host "[ALERT] RMM artifacts found on disk:" -ForegroundColor Red
    $foundFiles | ForEach-Object { Write-Host " - $($_.FullName) (Created: $($_.CreationTime))" -ForegroundColor Red }
} else {
    Write-Host "[OK] No RMM artifacts found in standard paths." -ForegroundColor Green
}

Write-Host "[+] Audit Complete." -ForegroundColor Cyan

Remediation

If compromised, immediate action is required to evict the attacker:

Isolate the Host: Disconnect affected endpoints from the network immediately to prevent further lateral movement via the installed RMM.
Terminate RMM Processes: Kill any instances of Level.exe, ScreenConnect services, or ConnectwiseControl processes.
Uninstall the Tool: Use the official vendor removal instructions to ensure all background services and hidden files are deleted. Do not simply delete the executable, as these tools often install persistent services.
Credential Reset: Assume the attacker has viewed the screen or typed credentials. Reset all passwords for accounts accessed on the compromised machine.
Review Access Logs: Audit the RMM vendor’s administrative console (if available) to determine the specific actions taken by the attacker during their session.
User Education: Brief the affected user on the mechanics of fake update prompts and the proper channels for legitimate software updates.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub