Loading malware…
Stuxnet is a sophisticated Windows worm discovered in 2010 that was designed to sabotage industrial control systems, specifically Siemens programmable logic controllers used in Iran’s uranium-enrichment centrifuges. Widely attributed to the United States and Israel, it demonstrated how compromise of Windows-based engineering and supervisory systems could enable physical disruption of industrial processes. Its industrial payload inserts or modifies controller program blocks, including on Siemens SIMATIC CPU 315-2 and CPU 417 systems, to alter control-system execution.
Stuxnet propagates through removable USB media, network shares, and exploitation of Windows vulnerabilities. It exploits the Windows shortcut vulnerability CVE-2010-2568, allowing malicious code execution when Windows displays a crafted shortcut’s icon, and spreads between networked systems through Print Spooler and Windows Server Service vulnerabilities addressed by MS10-061 and MS08-067. It also infects Siemens WinCC systems using a hardcoded database password and inserts malicious code into database views. Local privilege-escalation exploits include vulnerabilities in Windows kernel functionality and Task Scheduler. An embedded RPC server supports file transfer and peer-to-peer payload-version updates among infected computers within a victim network.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited in the wild in July 2010 by the Stuxnet worm.
The Stuxnet worm used LNK files to propagate by exploiting CVE-2010-2568. The article dates its first use by Trojan.Zlob to November 2008 and states that Microsoft issued MS10-046 on August 2, 2010.
Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited in the wild in July 2010 by the Stuxnet worm, and identified by Kaspersky Lab researchers and other researchers.
This attack makes additional use of a further vulnerability categorized as CVE-2010-2772, relating to the use of a hard-coded password in those systems allowing a local user to access a back-end database and gain privileged access to the system. | This report is devoted to the analysis of the notorious Stuxnet worm (Win32/Stuxnet)... We also describe the remote communication protocol that it uses to communicate with the remote C&C.
CVE-2010-2743 The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm, aka "Win32k Keyboard Layout Vulnerability." | CVE-2010-2743 ... allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm, aka "Win32k Keyboard Layout Vulnerability."
Stuxnet ... CVE-2008-4250 (RPC RCE) | Stuxnet ... was made for a sabotage operation of Iran’s nuclear program ... Even Stuxnet, best known for its sabotage capabilities, collected information about Siemens Simatic Step 7 engineering software projects found in compromised machines.
Stuxnet ... CVE-2010-3338 (Task Scheduler EoP) | Stuxnet ... was made for a sabotage operation of Iran’s nuclear program ... Even Stuxnet, best known for its sabotage capabilities, collected information about Siemens Simatic Step 7 engineering software projects found in compromised machines.
Infected Siemens Simatic Step7 project files using exploit for vulnerability CVE-2012-3015. | Stuxnet ... was made for a sabotage operation of Iran’s nuclear program ... Even Stuxnet, best known for its sabotage capabilities, collected information about Siemens Simatic Step 7 engineering software projects found in compromised machines.
Stuxnet ... CVE-2006-3439 (RPC RCE) | Stuxnet ... was made for a sabotage operation of Iran’s nuclear program ... Even Stuxnet, best known for its sabotage capabilities, collected information about Siemens Simatic Step 7 engineering software projects found in compromised machines.
Stuxnet was well known for its use of CVE-2010-2729, the Windows Print Spooler RCE exploit. Flame used it as well. | Stuxnet ... was made for a sabotage operation of Iran’s nuclear program ... Even Stuxnet, best known for its sabotage capabilities, collected information about Siemens Simatic Step 7 engineering software projects found in compromised machines.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Stuxnet targeted Siemens industrial controllers used at Iran's Natanz nuclear-enrichment plant. Its payload manipulated frequency converters in industrial centrifuges while reporting normal operations to plant staff.
“TAO’s coding savants helped craft the digital weapon known as Stuxnet.”
Ultimately, it turned out that the fortuitous discoveries of Stuxnet, Duqu, and Flame were in fact related beyond superficial succession.
The tranquil days of reverse engineering banking trojans were pierced by Stuxnet, Duqu, Flame, Gauss, and MiniFlame.
44 distinct techniques documented for this family, organized by ATT&CK tactic.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stealthy worm described as used by the US and Israel to sabotage Iranian nuclear centrifuges. Cited as a historical example, rather than as part of the AI-worm research.
Referenced as a historical milestone combining sophisticated engineering, tradecraft, espionage, and physical-world consequences, and as a personal memory of research with Péter Szőr. No connection to the telecommunications campaign is stated.
Malware/cyberarme utilisé contre des centrifugeuses nucléaires; cité comme exemple historique d’une attaque contre une infrastructure nucléaire avant les LLM modernes.
Named as a contrast to theoretical “Stunt Cryptography” attacks; the content characterizes Stuxnet as a real, exploitable threat that attackers actually used.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.