Nigeria-Based Group Targets Organizations with Redundant RMM Phishing Campaign

LONDON (July 27, 2026) — A cyber threat actor group operating from Nigeria known as Operation BlueDash has launched a sophisticated phishing campaign targeting organizations globally by masquerading as Microsoft Teams update notifications. The attack is designed to install multiple Remote Monitoring and Management (RMM) tools on victim systems simultaneously, creating redundant access channels that persist even if one tool is detected or removed.

Security researchers identified the campaign following an analysis of malicious emails sent in early July 2026. The phishing messages mimic official Microsoft Teams communications, urging recipients to click a link to download urgent software updates. Once activated, the payload executes a script that silently installs three distinct RMM applications: Level RMM, ScreenConnect, and Tactical RMM.

The deployment of multiple management tools represents a significant shift in operational strategy for Operation BlueDash. By establishing redundant remote access points, the group ensures continuous control over compromised networks. If security teams identify and remove one specific tool, such as ScreenConnect, the attackers retain immediate entry through Level RMM or Tactical RMM without needing to re-infect the system.

This approach addresses a common vulnerability in incident response where organizations focus on removing known malware signatures while overlooking alternative backdoors left behind by sophisticated actors. The use of legitimate-looking Microsoft branding lowers user suspicion, increasing the success rate of initial infection vectors compared to generic phishing attempts.

Operation BlueDash has previously been linked to financial theft and data exfiltration campaigns across West Africa and Europe. While specific targets for this latest wave have not been publicly disclosed, the broad distribution suggests a wide-ranging effort rather than targeted spear-phishing against single entities. The campaign exploits the trust organizations place in enterprise software notifications.

The installation of these tools grants attackers full administrative capabilities over infected machines, allowing them to move laterally within networks, deploy ransomware, or harvest sensitive credentials for future operations. Unlike previous attacks that relied on a single point of entry, this multi-layered approach complicates remediation efforts and extends the dwell time of adversaries within victim environments.

Cybersecurity firms are currently working with affected organizations to identify indicators of compromise associated with the fake update links and the specific configurations used by Operation BlueDash. The group remains active as researchers continue to track new variations of the phishing templates designed to bypass email filters.

It remains unclear whether this campaign is part of a larger coordinated effort involving other threat actors or if it signals an independent evolution in Nigerian cybercrime tactics. As organizations scramble to patch vulnerabilities and scan for unauthorized RMM installations, experts warn that the redundancy built into these attacks may require more aggressive network segmentation strategies to fully contain.