---
title: "Discussion on \"Operation BlueDash: When Legitimate RMM Becomes the Backdoor, and a Public GitHub Repo Tells the Whole Story\" | Hashnode"
description: "Discussion on \"Operation BlueDash: When Legitimate RMM Becomes the Backdoor, and a Public GitHub Repo Tells the Whole Story\". Summary\nThere is no malware in this campaign.\nThe final payload the victim receives is the official Level RMM installer, downloaded directly from Level's own infrastructure, installed via msiexec with"
url: "https://hashnode.com/posts/operation-bluedash-multi-rmm-abuse-en/6a86c6167912ba745623040c"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Operation BlueDash: When Legitimate RMM Becomes the Backdoor, and a Public GitHub Repo Tells the Whole Story](https://blog.fiscybersec.com/operation-bluedash-multi-rmm-abuse-en?utm_source=hashnode&utm_medium=feed)

Summary There is no malware in this campaign. The final payload the victim receives is the official Level RMM installer, downloaded directly from Level's own infrastructure, installed via msiexec with

Aug 20 · 23 min read · blog.fiscybersec.com  
Read the article

-   [#operation-bluedash](https://hashnode.com/tag/operation-bluedash)
-   [#rmm-abuse](https://hashnode.com/tag/rmm-abuse)
-   [#level-rmm](https://hashnode.com/tag/level-rmm)
-   [#screenconnect](https://hashnode.com/tag/screenconnect)
-   [#tactical-rmm](https://hashnode.com/tag/tactical-rmm)
-   [#supportdev](https://hashnode.com/tag/supportdev)
-   [#teams-phishing](https://hashnode.com/tag/teams-phishing)
-   [#fake-microsoft-store](https://hashnode.com/tag/fake-microsoft-store)
-   [#zoom-phishing](https://hashnode.com/tag/zoom-phishing)
-   [#inno-setup-loader](https://hashnode.com/tag/inno-setup-loader)
-   [#jscript-loader](https://hashnode.com/tag/jscript-loader)
-   [#github-pages-abuse](https://hashnode.com/tag/github-pages-abuse)
-   [#living-off-trusted-software](https://hashnode.com/tag/living-off-trusted-software)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)

## Written by

[Vũ Nhật Lâm](https://hashnode.com/@kami61)

@kami61

  
[View profile](https://hashnode.com/@kami61)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.