Loading malware…
Stuxnet is a highly sophisticated Windows worm and cyber-physical sabotage platform discovered in 2010 and widely assessed as a state-developed operation associated with the sabotage of Iran’s nuclear program. It is notable for bridging conventional malware tradecraft with industrial control system manipulation, enabling it to infect Windows hosts, propagate through removable media, establish stealthy persistence, communicate with command-and-control infrastructure, and ultimately alter industrial processes while masking the effects from operators.
The malware is strongly associated with air-gapped and semi-isolated environments because it spread via USB removable drives, including through exploitation of the Windows LNK vulnerability CVE-2010-2568. Stuxnet enumerates removable drives for infection and uses Windows service and driver-based persistence, including registration of a driver as a boot-start service. It also performs host reconnaissance such as enumerating running security-product processes, checking the Windows Registry for indicators of security software, enumerating domain user accounts, and querying system state to guide execution and evasion.
A defining characteristic of Stuxnet is its extensive defense-evasion engineering. Its USB loader component used userland rootkit techniques to hide malicious files, including API hooking of Windows file enumeration functions and native directory query routines. It employed obfuscated API resolution, PE validation, custom memory mapping, and repeated self-protection and cleanup logic to preserve stealth and reliability during propagation and staging.
Stuxnet’s strategic significance comes from its role as an early and influential example of malware designed to produce physical effects in operational technology environments. It has been cited as a representative PLC logic implant class capable of covertly modifying industrial behavior while reporting normal conditions upstream, contributing to equipment malfunction and destruction. It is also historically linked in public research to related advanced platforms such as Duqu and Flame, reflecting a broader ecosystem of state-grade cyber tooling.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The USB loader ~WTR4141.TMP runs automatically through triggering the file name “Copy of Shortcut to.lnk” in the USB device, which is exlointed by the LNK Vulnerability (CVE-2010-2568). | According to Wikipedia, Stuxnet is a malicious computer worm first uncovered on 17 June 2010... In this report I try to be focused on the small range on the USB loader ~WTR4141.TMP... Stuxnet ~WTR4141.TMP: USB Loader as a userland rootkit.
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Ultimately, it turned out that the fortuitous discoveries of Stuxnet, Duqu, and Flame were in fact related beyond superficial succession.
The tranquil days of reverse engineering banking trojans were pierced by Stuxnet, Duqu, Flame, Gauss, and MiniFlame.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
The USB loader ~WTR4141.TMP runs automatically through triggering the file name “Copy of Shortcut to.lnk” in the USB device... It loads itself from a removable drive to memory.
The ZwMapViewOfSection routine is the key to mapping a shared memory section into a process's address space. The loader uses two ZwMapViewOfSection routines for creating dual virtual address mappings for shared physical memory.
Fanny utilized two Stuxnet zero-days 1–2 years before Stuxnet entered the scene: the infamous LNK exploit (CVE-2010–2568)
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
you will find all technical details about the threat’s components and data structures, as well as high-level information, including: ... Injection techniques and anti-AV
Fanny utilized two Stuxnet zero-days 1–2 years before Stuxnet entered the scene: the infamous LNK exploit (CVE-2010–2568) and a privilege escalation embedded in the aforementioned Resource 207.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
In order to do anti-reverse engineering analysis, some key APIs are pre-obfuscated in ~WTR4141.TMP... deobfuscation via the XOR algorithm
you will find all technical details about the threat’s components and data structures, as well as high-level information, including: ... Injection techniques and anti-AV
In the case of Stuxnet, one of the former intelligence officials said that signatures were added by the Territorial Dispute team in 2010 after Stuxnet had begun to spread uncontrollably — spreading that led to its discovery and public exposure. “There were cleanup efforts,” the official said.
it destroys them with the design of a “robust delete” routine and tries 8 times to delete a file reliably, even if something blocks it and even if DeleteFile fails.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Drivers are often used to maintain access to an infected system and to hide suspicious activity from system administrators.
Hide the files via API chain hook both layers... kernel32.dll hook API as follows: FindFirstFileW FindNextFileW FindFirstFileExW ntdll.dll hook API as follows: NtQueryDirectoryFile ZwQueryDirectoryFile
Flame... was the first known attack to trick users in this way by hijacking the Microsoft Windows updating tool on machines to infect computers
It loads itself from a removable drive to memory and does the same way to the real payload ~WTR4132.TMP by reusable design. The loader avoids a direct LoadLibraryW call using a standard path; instead, it uses the specially crafted file name SHELL32.DLL.ASLR.[HEXADECIMAL]... mapped to a temporary region of memory
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
STUXSHOP: The Oldest Stuxnet Component Dials Up Stuxshop is ancient component folded into Stuxnet to manage it’s early command-and-control capabilities.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware associated with cyber sabotage that affects machines, infrastructure, and national security rather than only stealing data.
A cyber weapon used to sabotage Iran’s nuclear program.
Referenced as a historical example of malware that crossed air gaps via USB drives rather than radio-based covert exfiltration.
ICS malware that sabotaged industrial centrifuges while spoofing normal readings to upstream monitoring systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.