Operation BlueDash: Multi-RMM Workplace Phishing By ZeroBEC Team

Summary

Operation BlueDash is a sophisticated phishing campaign targeting workplace users with fake Microsoft Teams and Zoom update notifications. Attackers use counterfeit Microsoft Store pages to distribute loaders that silently enroll compromised endpoints into several Remote Monitoring and Management (RMM) platforms, including Level RMM, ScreenConnect, and Tactical RMM. This multi-channel setup gives the adversary redundant and resilient remote access to infected systems.

Investigation

The ZeroBEC investigation reconstructed the complete attack chain, from the initial phishing email through post-compromise reconnaissance. Researchers uncovered a public GitHub development environment containing phishing source code, custom domain configurations, and multiple loaders. Analysis of repository commit history showed how the campaign evolved from basic ScreenConnect delivery into a more advanced multi-RMM framework alongside a parallel Zoom-themed operation.

Mitigation

Organizations should enforce strong email and web controls to detect unsolicited document or software update lures. Technical defenses should include blocking unauthorized RMM tools through application control policies such as AppLocker or WDAC and monitoring for suspicious PowerShell activity. Maintaining an explicit allowlist of approved RMM products and their authorized enrollment keys is also strongly recommended.

Response

If unauthorized RMM enrollment is detected, security teams should immediately isolate the affected endpoint to limit further lateral movement. Every established remote-access channel should be removed, and all potentially compromised credentials should be rotated. After containment, responders should review RMM console activity and endpoint logs to determine the full scope of the compromise.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An attacker has successfully tricked a user into running a malicious .msi file via a spearphishing link (T1566.002). Once the user executes the MSI, the installer uses msiexec.exe to call powershell.exe. The PowerShell instance is instructed to download an RMM agent (T1105) and execute a discovery script (T1082) to identify the machine’s role in the network. This specific parent-child relationship (msiexec.exe -> powershell.exe) is the core indicator of the Operation BlueDash technique.

• Regression Test Script:

  # Simulation Script: Mimic MSI spawning PowerShell
  # Note: Since we cannot easily 'become' an MSI installer in a script, 
  # we simulate the process tree by spawning PowerShell from a process 
  # that mimics the behavior, or manually launching msiexec to call powershell.
  
  $targetPayload = "https://example.com/rmm_agent.msi"
  $psCommand = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command `"Write-Host 'Simulating RMM Download from $targetPayload'; Start-Sleep -s 5`""
  
  Write-Host "[+] Starting Simulation: Spawning PowerShell via Msiexec..." -ForegroundColor Cyan
  
  # We use msiexec to launch the command to satisfy the ParentImage requirement of the rule
  # The /i flag with a dummy command allows us to trigger the execution engine
  Start-Process msiexec.exe -ArgumentList "/i $psCommand"
  
  Write-Host "[+] Simulation command sent. Check Sysmon Event ID 1 for: ParentImage: msiexec.exe | Image: powershell.exe" -ForegroundColor Green

• Cleanup Commands:

  # Cleanup: Ensure no lingering PowerShell processes are running from the simulation
  Get-Process powershell | Where-Object { $_.CommandLine -like "*Simulating RMM Download*" } | Stop-Process -Force
  Write-Host "[+] Cleanup complete. Simulated processes terminated." -ForegroundColor Yellow