{"id":49137,"date":"2025-09-17T18:18:27","date_gmt":"2025-09-17T18:18:27","guid":{"rendered":"https:\/\/becolve.com\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/"},"modified":"2025-09-17T18:18:27","modified_gmt":"2025-09-17T18:18:27","slug":"como-e-que-o-dragonfly-afeta-os-sistemas-scada","status":"publish","type":"blog","link":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/","title":{"rendered":"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?"},"content":{"rendered":"<p class=\"p1\"><b>Dragonfly<\/b> \u00e9 uma APT (Advanced Persistent Threat) que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas pertencentes a diferentes setores.<\/p>\n<p class=\"p1\"><!--more--><\/p>\n<p class=\"p1\">Inicialmente, a Dragonfly afetou as instala\u00e7\u00f5es do <a href=\"http:\/\/www.symantec.com\/connect\/blogs\/dragonfly-western-energy-companies-under-sabotage-threat?SID=skim26001X849541Xfc1f2270c49604af3baa1cff2662d0cc&amp;API1=100&amp;API2=5635367&amp;cjid=5635367\"><span class=\"s1\">setor el\u00e9trico<\/span><\/a>, mas recentemente descobriu-se como os <a href=\"https:\/\/www.tofinosecurity.com\/blog\/dragonfly-malware-targets-ics-systems\"><span class=\"s1\">setores farmac\u00eauticos, de alimenta\u00e7\u00e3o e bebidas e de \u00e1guas<\/span><\/a> tamb\u00e9m s\u00e3o alvo deste malware.<\/p>\n<p class=\"p1\">Para levar a cabo os seus objetivos, entre os quais se encontram os de comprometer equipamentos, obter palavras-passe e informa\u00e7\u00f5es, degradar o desempenho do sistema, aceder por portas traseiras, facilitar a escrita n\u00e3o autorizada sobre equipamentos associados a ambientes de TI e TO ou realizar nega\u00e7\u00f5es de servi\u00e7o, utilizava tr\u00eas RAT (Remote Access Toolkit):<\/p>\n<ul>\n<ul>\n<li>HAVEX (tamb\u00e9m denominado Backdoor.Oldrea ou Energetic Bear RAT)<\/li>\n<li>Karagany<\/li>\n<li>Sysmain<\/li>\n<\/ul>\n<\/ul>\n<p class=\"p1\">Em qualquer um dos tr\u00eas casos, os objetivos dos RAT eram os de permanecer no alvo (PC infetado), normalmente atrav\u00e9s de um troiano, e facilitar a comunica\u00e7\u00e3o com o C2 (Command&amp;Control) para se atualizar e executar m\u00f3dulos adicionais (payloads).<\/p>\n<p class=\"p1\"><strong>Dragonfly<\/strong> utilizava tr\u00eas vetores de ataque:<\/p>\n<ul>\n<ul>\n<li>A\u00e7\u00f5es de e-mail spear-fishing<\/li>\n<li>Ataques de Watering hole (baseados em clickjacking)<\/li>\n<li>Infe\u00e7\u00e3o atrav\u00e9s de troianos descarregados de websites de fornecedores ICS<\/li>\n<\/ul>\n<\/ul>\n<p class=\"p1\">No que diz respeito ao <b>e-mail spear-fishing<\/b>, o ataque ocorreu atrav\u00e9s do envio de e-mails a diretores de 7 empresas do setor el\u00e9trico, nos quais era anexado um ficheiro do tipo Adobe XML Data Package (XDP). O assunto do e-mail era descrito como: \u201cThe account\u201d e\/ou \u201cSettlement of delivery problema\u201d. O ficheiro XDP utilizado pela Dragonfly aproveitava a vulnerabilidade <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2011-0611\"><span class=\"s1\">CVE-2011-0611<\/span><\/a> de PDF\/SWF, permitindo que a biblioteca PE-DLL de Havex fosse desencriptada, instalada e executada.  <\/p>\n<p class=\"p1\">Os ataques de <b>Watering hole<\/b> ocorriam atrav\u00e9s de clickjacking. Diferentes iFrames ocultos em espa\u00e7os web confi\u00e1veis, redirecionavam as v\u00edtimas para outros sites maliciosos. Os espa\u00e7os web confi\u00e1veis eram sites baseados em gestores de conte\u00fados do tipo WordPress, Drupal ou Joomla. Os espa\u00e7os maliciosos continham c\u00f3digo JAVA e HTML malicioso que permitiam explorar as vulnerabilidades CVE-2012-1723, CVE-2013-2465 de JAVA e as CVE-2012-4792 e CVE-2013-1347 de Internet Explorer. Isto facilitava a instala\u00e7\u00e3o de HAVEX nos PC\u00b4s dos visitantes destas p\u00e1ginas.    <\/p>\n<p class=\"p1\">Por \u00faltimo, as <b>p\u00e1ginas web<\/b> das empresas Mesa Imaging (fornecedor de c\u00e2maras utilizadas para vis\u00e3o guiada de ve\u00edculos em ambientes industriais, eWon e MB Connect (fornecedores de solu\u00e7\u00f5es para o acesso remoto e telemunuten\u00e7\u00e3o de ambientes industriais) foram infetadas, de modo a que os utilizadores descarregassem software, em princ\u00edpio n\u00e3o malicioso (drivers principalmente), que continham diferentes tipos de troianos.<\/p>\n<p class=\"p1\">Se quiser saber mais, recomendamos que assista ao nosso <a href=\"http:\/\/www.ciberseguridadlogitek.com\/dragonfly-y-sandworm-malware-en-entornos-scada-analisis-y-propuesta-de-contramedidas\/\"><span class=\"s1\">webinar.<\/span><\/a><\/p>\n<p class=\"p1\">\n","protected":false},"excerpt":{"rendered":"<p>Dragonfly \u00e9 uma APT (Advanced Persistent Threat) que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas pertencentes a diferentes setores.<\/p>\n","protected":false},"author":31,"featured_media":49138,"menu_order":0,"template":"","categories":[969],"tags":[],"arquitectura":[1838],"area":[],"sector":[],"experto":[203],"weborigen":[157],"productos-tax":[],"soluciones-tax":[],"marcas-tax":[],"coauthors":[],"class_list":["post-49137","blog","type-blog","status-publish","has-post-thumbnail","hentry","category-ciberseguranca","arquitectura-ciberseguranca-industrial","experto-ciberseguranca-industrial-disponibilidade-total","weborigen-ciberseguridadlogitek-com"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.3 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Como \u00e9 que o Dragonfly afeta os sistemas SCADA?<\/title>\n<meta name=\"description\" content=\"Dragonfly \u00e9 uma APT que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas. Mas como \u00e9 que isto afeta os sistemas SCADA?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/\" \/>\n<meta property=\"og:locale\" content=\"pt_PT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?\" \/>\n<meta property=\"og:description\" content=\"Dragonfly \u00e9 uma APT que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas. Mas como \u00e9 que isto afeta os sistemas SCADA?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/\" \/>\n<meta property=\"og:site_name\" content=\"Becolve Digital\" \/>\n<meta property=\"og:image\" content=\"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"620\" \/>\n\t<meta property=\"og:image:height\" content=\"250\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:site\" content=\"@Logitek_es\" \/>\n<meta name=\"twitter:label1\" content=\"Tempo estimado de leitura\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutos\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"Becolve Digital\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/\",\"name\":\"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/DRAGONFLY.jpg\",\"datePublished\":\"2025-09-17T18:18:27+00:00\",\"description\":\"Dragonfly \u00e9 uma APT que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas. Mas como \u00e9 que isto afeta os sistemas SCADA?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/#breadcrumb\"},\"inLanguage\":\"pt-PT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/#primaryimage\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/DRAGONFLY.jpg\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/DRAGONFLY.jpg\",\"width\":620,\"height\":250},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog Items\",\"item\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/#website\",\"url\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/\",\"name\":\"Becolve Digital\",\"description\":\"Impulsamos la transformaci\u00f3n digital en la industria e infraestructuras\",\"publisher\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-PT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/#organization\",\"name\":\"Becolve Digital\",\"url\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-PT\",\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"contentUrl\":\"https:\\\/\\\/becolve.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/becolve-logo-h-black_200.png\",\"width\":200,\"height\":64,\"caption\":\"Becolve Digital\"},\"image\":{\"@id\":\"https:\\\/\\\/becolve.com\\\/pt-pt\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Logitek_es\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/becolve-digital\\\/\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?","description":"Dragonfly \u00e9 uma APT que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas. Mas como \u00e9 que isto afeta os sistemas SCADA?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/","og_locale":"pt_PT","og_type":"article","og_title":"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?","og_description":"Dragonfly \u00e9 uma APT que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas. Mas como \u00e9 que isto afeta os sistemas SCADA?","og_url":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/","og_site_name":"Becolve Digital","og_image":[{"width":620,"height":250,"url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_site":"@Logitek_es","twitter_misc":{"Tempo estimado de leitura":"2 minutos","Written by":"Becolve Digital"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/","url":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/","name":"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?","isPartOf":{"@id":"https:\/\/becolve.com\/pt-pt\/#website"},"primaryImageOfPage":{"@id":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/#primaryimage"},"image":{"@id":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/#primaryimage"},"thumbnailUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","datePublished":"2025-09-17T18:18:27+00:00","description":"Dragonfly \u00e9 uma APT que infetou, atrav\u00e9s da realiza\u00e7\u00e3o de ataques em profundidade, mais de 2.470 v\u00edtimas. Mas como \u00e9 que isto afeta os sistemas SCADA?","breadcrumb":{"@id":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/#breadcrumb"},"inLanguage":"pt-PT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/"]}]},{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/#primaryimage","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/DRAGONFLY.jpg","width":620,"height":250},{"@type":"BreadcrumbList","@id":"https:\/\/becolve.com\/pt-pt\/blog\/como-e-que-o-dragonfly-afeta-os-sistemas-scada\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/becolve.com\/pt-pt\/"},{"@type":"ListItem","position":2,"name":"Blog Items","item":"https:\/\/becolve.com\/pt-pt\/blog\/"},{"@type":"ListItem","position":3,"name":"Como \u00e9 que o Dragonfly afeta os sistemas SCADA?"}]},{"@type":"WebSite","@id":"https:\/\/becolve.com\/pt-pt\/#website","url":"https:\/\/becolve.com\/pt-pt\/","name":"Becolve Digital","description":"Impulsamos la transformaci\u00f3n digital en la industria e infraestructuras","publisher":{"@id":"https:\/\/becolve.com\/pt-pt\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/becolve.com\/pt-pt\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-PT"},{"@type":"Organization","@id":"https:\/\/becolve.com\/pt-pt\/#organization","name":"Becolve Digital","url":"https:\/\/becolve.com\/pt-pt\/","logo":{"@type":"ImageObject","inLanguage":"pt-PT","@id":"https:\/\/becolve.com\/pt-pt\/#\/schema\/logo\/image\/","url":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","contentUrl":"https:\/\/becolve.com\/wp-content\/uploads\/2023\/04\/becolve-logo-h-black_200.png","width":200,"height":64,"caption":"Becolve Digital"},"image":{"@id":"https:\/\/becolve.com\/pt-pt\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Logitek_es","https:\/\/www.linkedin.com\/company\/becolve-digital\/"]}]}},"_links":{"self":[{"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/blog\/49137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/blog"}],"about":[{"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/types\/blog"}],"author":[{"embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/users\/31"}],"version-history":[{"count":0,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/blog\/49137\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/media\/49138"}],"wp:attachment":[{"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/media?parent=49137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/categories?post=49137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/tags?post=49137"},{"taxonomy":"arquitectura","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/arquitectura?post=49137"},{"taxonomy":"area","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/area?post=49137"},{"taxonomy":"sector","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/sector?post=49137"},{"taxonomy":"experto","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/experto?post=49137"},{"taxonomy":"weborigen","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/weborigen?post=49137"},{"taxonomy":"productos-tax","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/productos-tax?post=49137"},{"taxonomy":"soluciones-tax","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/soluciones-tax?post=49137"},{"taxonomy":"marcas-tax","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/marcas-tax?post=49137"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/becolve.com\/pt-pt\/wp-json\/wp\/v2\/coauthors?post=49137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}