Loading threat actor…
Operation BlueDash is a phishing campaign that uses fake Microsoft Teams update lures to trick users into installing a malicious package that grants attackers remote access to compromised systems. Victims are enticed through phishing emails and redirected via compromised websites to a spoofed Microsoft Store experience that impersonates a legitimate Teams update workflow. The delivered installer is an Inno Setup package that launches hidden PowerShell to deploy legitimate remote monitoring and management software, including Level RMM, and also attempts to install ScreenConnect as a redundant remote-access channel. The operation’s use of signed administrative tools is designed to blend malicious activity with normal enterprise IT operations and improve resilience if one access path is disrupted. Post-compromise activity includes hands-on reconnaissance to assess host state and administrative posture, including checks related to reboot status, disk encryption, firewall configuration, and local administrator membership. The campaign has also shown overlap in tradecraft with a parallel Zoom-themed operation that used similar social-engineering and remote-management abuse, including Tactical RMM. Operation BlueDash is best characterized as an initial-access and post-exploitation intrusion set centered on phishing, spoofing, remote administration abuse, and operator-driven reconnaissance.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.