Loading malware…
Stuxnet is a highly sophisticated Windows worm and cyber-physical sabotage platform best known for targeting industrial control systems associated with Iran’s nuclear program. Public reporting and technical analysis have long linked it to a state-sponsored operation widely attributed to the United States and Israel. Unlike conventional espionage malware focused primarily on data theft, Stuxnet combined propagation, stealth, and industrial manipulation capabilities to move from Windows hosts into operational technology environments and alter programmable logic controller behavior in ways that could degrade or damage physical equipment while masking the effects from operators.
Stuxnet spread through multiple mechanisms, including removable media, and is notably associated with exploitation of the Windows LNK vulnerability CVE-2010-2568 to execute from USB devices in air-gapped or semi-isolated environments. It propagated more broadly than its intended target set, which contributed to its eventual discovery in 2010. On infected Windows systems, Stuxnet performed extensive environmental awareness and defense-related checks, including enumerating running security products, querying the Windows Registry, and identifying removable drives for further infection. It also established persistence through registry changes and driver-loading mechanisms.
A key component of Stuxnet’s tradecraft was stealth. Technical analyses of its USB loader and related components describe user-mode rootkit behavior, API hooking, obfuscated strings, custom memory mapping, and file-hiding logic designed to conceal staged payloads on removable media and reduce the chance of user discovery or analyst inspection. Stuxnet also used kernel-level components and trusted-driver abuse to support concealment and reliable execution.
Its strategic significance comes from its ability to bridge traditional IT compromise and OT impact. Stuxnet is widely regarded as the first malware to demonstrate large-scale, real-world cyber sabotage against industrial processes, specifically by manipulating PLC logic while hiding malicious changes from engineers and operators. It became a defining example of PLC logic implants, cyber-physical attack design, and the risks posed by malware that can cross air gaps via USB and then affect machinery, infrastructure, and national security outcomes.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The USB loader ~WTR4141.TMP runs automatically through triggering the file name “Copy of Shortcut to.lnk” in the USB device, which is exlointed by the LNK Vulnerability (CVE-2010-2568). | According to Wikipedia, Stuxnet is a malicious computer worm first uncovered on 17 June 2010... In this report I try to be focused on the small range on the USB loader ~WTR4141.TMP... Stuxnet ~WTR4141.TMP: USB Loader as a userland rootkit.
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Ultimately, it turned out that the fortuitous discoveries of Stuxnet, Duqu, and Flame were in fact related beyond superficial succession.
The tranquil days of reverse engineering banking trojans were pierced by Stuxnet, Duqu, Flame, Gauss, and MiniFlame.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
The USB loader ~WTR4141.TMP runs automatically through triggering the file name “Copy of Shortcut to.lnk” in the USB device... It loads itself from a removable drive to memory.
The ZwMapViewOfSection routine is the key to mapping a shared memory section into a process's address space. The loader uses two ZwMapViewOfSection routines for creating dual virtual address mappings for shared physical memory.
Fanny utilized two Stuxnet zero-days 1–2 years before Stuxnet entered the scene: the infamous LNK exploit (CVE-2010–2568)
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
you will find all technical details about the threat’s components and data structures, as well as high-level information, including: ... Injection techniques and anti-AV
Fanny utilized two Stuxnet zero-days 1–2 years before Stuxnet entered the scene: the infamous LNK exploit (CVE-2010–2568) and a privilege escalation embedded in the aforementioned Resource 207.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
In order to do anti-reverse engineering analysis, some key APIs are pre-obfuscated in ~WTR4141.TMP... deobfuscation via the XOR algorithm
you will find all technical details about the threat’s components and data structures, as well as high-level information, including: ... Injection techniques and anti-AV
In the case of Stuxnet, one of the former intelligence officials said that signatures were added by the Territorial Dispute team in 2010 after Stuxnet had begun to spread uncontrollably — spreading that led to its discovery and public exposure. “There were cleanup efforts,” the official said.
it destroys them with the design of a “robust delete” routine and tries 8 times to delete a file reliably, even if something blocks it and even if DeleteFile fails.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Drivers are often used to maintain access to an infected system and to hide suspicious activity from system administrators.
Hide the files via API chain hook both layers... kernel32.dll hook API as follows: FindFirstFileW FindNextFileW FindFirstFileExW ntdll.dll hook API as follows: NtQueryDirectoryFile ZwQueryDirectoryFile
Flame... was the first known attack to trick users in this way by hijacking the Microsoft Windows updating tool on machines to infect computers
It loads itself from a removable drive to memory and does the same way to the real payload ~WTR4132.TMP by reusable design. The loader avoids a direct LoadLibraryW call using a standard path; instead, it uses the specially crafted file name SHELL32.DLL.ASLR.[HEXADECIMAL]... mapped to a temporary region of memory
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
STUXSHOP: The Oldest Stuxnet Component Dials Up Stuxshop is ancient component folded into Stuxnet to manage it’s early command-and-control capabilities.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A worm referenced as a historical example of malware used to target operational technology and PLCs in Iran’s nuclear program.
A destructive worm referenced as having been used to damage systems involved in Iran's nuclear program.
Referenced only as the subject of the author's book about a digital weapon; no operational details are discussed in this content.
Referenced as a notorious sabotage malware for comparison with Fast16.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.