{"id":61093,"date":"2025-09-26T11:14:59","date_gmt":"2025-09-26T11:14:59","guid":{"rendered":"https:\/\/becolve.com\/blog\/how-does-dragonfly-affect-scada-systems\/"},"modified":"2025-09-26T11:14:59","modified_gmt":"2025-09-26T11:14:59","slug":"how-does-dragonfly-affect-scada-systems","status":"publish","type":"blog","link":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/","title":{"rendered":"How Does Dragonfly Affect SCADA Systems?"},"content":{"rendered":"<p class=\"p1\"><b>Dragonfly<\/b> is an APT (Advanced Persistent Threat) that has infected more than 2,470 victims from different sectors by carrying out in-depth attacks.<\/p>\n<p class=\"p1\"><!--more--><\/p>\n<p class=\"p1\">Initially, Dragonfly affected the facilities of the <a href=\"http:\/\/www.symantec.com\/connect\/blogs\/dragonfly-western-energy-companies-under-sabotage-threat?SID=skim26001X849541Xfc1f2270c49604af3baa1cff2662d0cc&amp;API1=100&amp;API2=5635367&amp;cjid=5635367\"><span class=\"s1\">electric sector<\/span><\/a>, but it has recently been discovered how the <a href=\"https:\/\/www.tofinosecurity.com\/blog\/dragonfly-malware-targets-ics-systems\"><span class=\"s1\">pharmaceutical, food and beverage, and water sectors<\/span><\/a> are also targeted by this malware.<\/p>\n<p class=\"p1\">To carry out its objectives, which include compromising equipment, obtaining passwords and information, degrading system performance, accessing through back doors, facilitating unauthorized writing on equipment associated with IT and OT environments, or carrying out denial-of-service attacks, it used three RATs (Remote Access Toolkits):<\/p>\n<ul>\n<ul>\n<li>HAVEX (also called Backdoor.Oldrea or Energetic Bear RAT)<\/li>\n<li>Karagany<\/li>\n<li>Sysmain<\/li>\n<\/ul>\n<\/ul>\n<p class=\"p1\">In any of the three cases, the objectives of the RATs were to remain on the target (infected PC), usually through a Trojan, and facilitate communication with the C2 (Command&amp;Control) to update and execute additional modules (payloads).<\/p>\n<p class=\"p1\"><strong>Dragonfly<\/strong> used three attack vectors:<\/p>\n<ul>\n<ul>\n<li>Spear-phishing email actions<\/li>\n<li>Watering hole attacks (based on clickjacking)<\/li>\n<li>Infection through Trojans downloaded from ICS vendor websites<\/li>\n<\/ul>\n<\/ul>\n<p class=\"p1\">Regarding <b>eMail spear-fishing<\/b>, the attack occurred by sending emails to managers of 7 companies in the electricity sector, in which an Adobe XML Data Package (XDP) file was attached. The subject of the email was described as: \u201cThe account\u201d and\/or \u201cSettlement of delivery problema\u201d. The XDP file used by Dragonfly took advantage of the <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2011-0611\"><span class=\"s1\">CVE-2011-0611<\/span><\/a> vulnerability of PDF\/SWF, allowing the PE-DLL library of Havex to be decrypted, installed, and executed.  <\/p>\n<p class=\"p1\">The <b>Watering hole<\/b> attacks occurred through clickjacking. Different iFrames hidden in trusted web spaces redirected victims to other malicious sites. The trusted web spaces were sites based on content managers such as WordPress, Drupal, or Joomla. The malicious spaces contained malicious JAVA and HTML code that allowed exploiting the vulnerabilities CVE-2012-1723, CVE-2013-2465 of JAVA and CVE-2012-4792 and CVE-2013-1347 of Internet Explorer. This facilitated the installation of HAVEX on the PCs of visitors to these pages.    <\/p>\n<p class=\"p1\">Finally, the <b>web pages<\/b> of the companies Mesa Imaging (supplier of cameras used for guided vision of vehicles in industrial environments, eWon and MB Connect (suppliers of solutions for remote access and remote maintenance of industrial environments) were infected, so that users downloaded software in principle not malicious (mainly drivers), which contained different types of Trojans.<\/p>\n<p class=\"p1\">If you want to know more, we recommend that you attend our <a href=\"http:\/\/www.ciberseguridadlogitek.com\/dragonfly-y-sandworm-malware-en-entornos-scada-analisis-y-propuesta-de-contramedidas\/\"><span class=\"s1\">webinar.<\/span><\/a><\/p>\n<p class=\"p1\">\n","protected":false},"excerpt":{"rendered":"<p>Dragonfly is an APT (Advanced Persistent Threat) that has infected more than 2,470 victims from different sectors by carrying out in-depth attacks.<\/p>\n","protected":false},"author":31,"featured_media":61094,"menu_order":0,"template":"","categories":[1371],"tags":[],"arquitectura":[1839],"area":[],"sector":[],"experto":[1396],"weborigen":[157],"productos-tax":[],"soluciones-tax":[],"marcas-tax":[],"coauthors":[],"class_list":["post-61093","blog","type-blog","status-publish","has-post-thumbnail","hentry","category-cybersecurity","arquitectura-industrial-cybersecurity","experto-industrial-cybersecurity-total-availability","weborigen-ciberseguridadlogitek-com"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How does Dragonfly affect SCADA systems?<\/title>\n<meta name=\"description\" content=\"Dragonfly is an APT that has infected more than 2,470 victims by carrying out in-depth attacks. But how does it affect SCADA systems?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How does Dragonfly affect SCADA systems?\" \/>\n<meta property=\"og:description\" content=\"Dragonfly is an APT that has infected more than 2,470 victims by carrying out in-depth attacks. But how does it affect SCADA systems?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/\" \/>\n<meta property=\"og:site_name\" content=\"Becolve Digital\" \/>\n<meta property=\"og:image\" content=\"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"620\" \/>\n\t<meta property=\"og:image:height\" content=\"250\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@Logitek_es\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Becolve Digital\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/\",\"name\":\"How does Dragonfly affect SCADA systems?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/DRAGONFLY.jpg\",\"datePublished\":\"2025-09-26T11:14:59+00:00\",\"description\":\"Dragonfly is an APT that has infected more than 2,470 victims by carrying out in-depth attacks. But how does it affect SCADA systems?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/#primaryimage\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/DRAGONFLY.jpg\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/DRAGONFLY.jpg\",\"width\":620,\"height\":250},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/how-does-dragonfly-affect-scada-systems\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/becolve.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog Items\",\"item\":\"https:\\\/\\\/becolve.com\\\/en\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"How Does Dragonfly Affect SCADA Systems?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/\",\"name\":\"Becolve Digital\",\"description\":\"Transformaci\u00f3n digital en industria e infraestructuras\",\"publisher\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/becolve.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#organization\",\"name\":\"Becolve Digital\",\"url\":\"https:\\\/\\\/becolve.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"width\":200,\"height\":64,\"caption\":\"Becolve Digital\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Logitek_es\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/becolve-digital\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How does Dragonfly affect SCADA systems?","description":"Dragonfly is an APT that has infected more than 2,470 victims by carrying out in-depth attacks. But how does it affect SCADA systems?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/","og_locale":"en_US","og_type":"article","og_title":"How does Dragonfly affect SCADA systems?","og_description":"Dragonfly is an APT that has infected more than 2,470 victims by carrying out in-depth attacks. But how does it affect SCADA systems?","og_url":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/","og_site_name":"Becolve Digital","og_image":[{"width":620,"height":250,"url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@Logitek_es","twitter_misc":{"Est. reading time":"2 minutes","Written by":"Becolve Digital"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/","url":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/","name":"How does Dragonfly affect SCADA systems?","isPartOf":{"@id":"https:\/\/becolve.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/#primaryimage"},"image":{"@id":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/#primaryimage"},"thumbnailUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","datePublished":"2025-09-26T11:14:59+00:00","description":"Dragonfly is an APT that has infected more than 2,470 victims by carrying out in-depth attacks. But how does it affect SCADA systems?","breadcrumb":{"@id":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/#primaryimage","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","width":620,"height":250},{"@type":"BreadcrumbList","@id":"https:\/\/becolve.com\/en\/blog\/how-does-dragonfly-affect-scada-systems\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/becolve.com\/en\/"},{"@type":"ListItem","position":2,"name":"Blog Items","item":"https:\/\/becolve.com\/en\/blog\/"},{"@type":"ListItem","position":3,"name":"How Does Dragonfly Affect SCADA Systems?"}]},{"@type":"WebSite","@id":"https:\/\/becolve.com\/en\/#website","url":"https:\/\/becolve.com\/en\/","name":"Becolve Digital","description":"Transformaci\u00f3n digital en industria e infraestructuras","publisher":{"@id":"https:\/\/becolve.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/becolve.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/becolve.com\/en\/#organization","name":"Becolve Digital","url":"https:\/\/becolve.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/becolve.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","width":200,"height":64,"caption":"Becolve Digital"},"image":{"@id":"https:\/\/becolve.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Logitek_es","https:\/\/www.linkedin.com\/company\/becolve-digital\/"]}]}},"_links":{"self":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog\/61093","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/users\/31"}],"version-history":[{"count":0,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/blog\/61093\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/media\/61094"}],"wp:attachment":[{"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/media?parent=61093"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/categories?post=61093"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/tags?post=61093"},{"taxonomy":"arquitectura","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/arquitectura?post=61093"},{"taxonomy":"area","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/area?post=61093"},{"taxonomy":"sector","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/sector?post=61093"},{"taxonomy":"experto","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/experto?post=61093"},{"taxonomy":"weborigen","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/weborigen?post=61093"},{"taxonomy":"productos-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/productos-tax?post=61093"},{"taxonomy":"soluciones-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/soluciones-tax?post=61093"},{"taxonomy":"marcas-tax","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/marcas-tax?post=61093"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/becolve.com\/en\/wp-json\/wp\/v2\/coauthors?post=61093"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}