{
  "family": "stuxnet",
  "sample_count": 15,
  "category": "advanced_threat",
  "description": "Stuxnet is widely recognized in military and cybersecurity history as the world's first true cyber weapon, uncovered in June 2010 by VirusBlokAda and subsequently determined to be the product of Operation Olympic Games, a joint intelligence operation by the United States and Israel. Explicitly engineered to physically sabotage the uranium enrichment centrifuges at the heavily guarded, air-gapped Natanz nuclear enrichment facility in Iran, Stuxnet achieved unprecedented technical sophistication that permanently transformed military doctrine and critical infrastructure security. To infiltrate the strictly air-gapped facility, Stuxnet was introduced via infected USB flash drives, weaponizing four separate Windows zero-day vulnerabilities in a single payload: the infamous Windows Shell LNK icon handling vulnerability (CVE-2010-2568), the Server Service RPC buffer overflow (CVE-2008-4250 / MS08-067), the Print Spooler service elevation flaw (CVE-2010-2729), and a Win32k.sys true-type font vulnerability. The worm was signed with stolen digital certificates from legitimate semiconductor hardware manufacturers Realtek and JMicron to bypass driver signature verification. Once inside a network, Stuxnet quietly mapped the environment, specifically searching for Siemens SIMATIC Step7 PLC (programmable logic controller) software controlling S7-300 and S7-400 systems managing frequency converter drives. Stuxnet covertly intercepted and modified PLC ladder logic code: it forced targeted centrifuge rotors to violently speed up to 1,410 Hz (far beyond their rated design tolerance) and then slow down to 2 Hz, inducing catastrophic mechanical stress and destroying approximately 1,000 centrifuges, while simultaneously spoofing normal operational sensor readings to control room monitors.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "Rootkit.Win32.Stuxnet",
    "W32.Stuxnet",
    "Operation Olympic Games",
    "Stuxnet Industrial Worm"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was Stuxnet and what was its objective?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stuxnet was the first weaponized industrial cyber weapon, developed under Operation Olympic Games to physically destroy uranium enrichment centrifuges at the Iranian Natanz nuclear facility."
      }
    },
    {
      "@type": "Question",
      "name": "How did Stuxnet cross air-gapped network perimeters?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stuxnet spread via infected USB flash drives by exploiting a zero-day vulnerability in Windows shortcut icon parsing (CVE-2010-2568), executing automatically upon viewing the drive contents."
      }
    },
    {
      "@type": "Question",
      "name": "How did Stuxnet sabotage the centrifuges?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injected rogue code into Siemens Step7 PLCs to spin centrifuges at destructively high and low speeds while sending fake normal sensor telemetry to human operators in the control room."
      }
    },
    {
      "@type": "Question",
      "name": "How many zero-day vulnerabilities did Stuxnet weaponize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stuxnet famously weaponized four distinct zero-days: CVE-2010-2568 (LNK shortcut flaw), CVE-2008-4250 (MS08-067 NetAPI), CVE-2010-2729 (Print Spooler), and a Win32k privilege escalation flaw."
      }
    },
    {
      "@type": "Question",
      "name": "What other malware families are linked to Stuxnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stuxnet shares significant architecture, modular frameworks, and codebase components with other advanced cyber espionage tools, including Duqu, Flame, and Gauss."
      }
    },
    {
      "@type": "Question",
      "name": "How did Stuxnet intercept and falsify Profibus PLC communications to centrifuges at the Natanz enrichment facility?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stuxnet specifically targeted Siemens Simatic S7-300 Programmable Logic Controllers (PLCs) controlling frequency converter drives connected to IR-1 uranium enrichment centrifuges. It intercepted Step 7 software calls by replacing s7otbxdx.dll. Once installed on the PLC, Stuxnet altered centrifuge rotor speeds from 1,064 Hz down to 2 Hz and up to 1,410 Hz to induce catastrophic physical resonance and structural failure, all while replaying recorded normal telemetry to monitoring consoles to deceive plant operators."
      }
    },
    {
      "@type": "Question",
      "name": "What four zero-day vulnerabilities, including CVE-2010-2568 (.LNK exploit), did Stuxnet exploit for autonomous propagation?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Stuxnet achieved unprecedented autonomous propagation across air-gapped industrial environments by weaponizing four simultaneous Microsoft zero-day vulnerabilities: the CVE-2010-2568 Windows Shell Shortcut (.LNK) code execution flaw (exploited via USB thumb drives), CVE-2010-2729 Windows Print Spooler service vulnerability, and two local privilege escalation flaws (CVE-2010-2743 and CVE-2010-3338) in the Windows kernel Win32k.sys driver."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1204.002",
    "T1091",
    "T1210",
    "T1068",
    "T1547.001",
    "T1055",
    "T1027",
    "T1082"
  ],
  "cisa_advisory": null,
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2008-4250"
  ],
  "iocs": {
    "file_hashes": [
      "5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102",
      "a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671"
    ],
    "delivery": [
      "Removable USB flash drive propagation exploiting Windows LNK shortcut parsing flaw CVE-2010-2568",
      "Network propagation across internal subnets exploiting MS08-067 NetAPI flaw CVE-2008-4250 and Print Spooler"
    ],
    "persistence": [
      "Signed kernel-mode device driver installation using stolen Realtek and JMicron certificates",
      "SSDT hooking in kernel memory to hide .LNK and temporary files on removable media"
    ]
  },
  "lineage": {
    "derived_from": [
      "olympic_games_framework"
    ],
    "variants": [
      "stuxnet_0.5",
      "stuxnet_1.0",
      "duqu_relative",
      "flame_relative"
    ]
  },
  "ecosystem": [
    "windows",
    "ics_scada",
    "siemens_s7"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "privilege_escalation",
    "defense_evasion",
    "lateral_movement",
    "impact"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "Symantec Security Response: W32.Stuxnet Dossier",
      "url": "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf"
    },
    {
      "name": "Wired: Countdown to Zero Day - The Story of Stuxnet",
      "url": "https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/"
    },
    {
      "name": "CISA: Industrial Control Systems Joint Analysis of Stuxnet",
      "url": "https://www.cisa.gov/uscert/ics"
    }
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}