The Demon Stuxnet, Who Made Centrifuges Dizzy

Legend

Discovered in June 2010, it targeted Siemens Step7 software and the controllers of Iran's uranium-enrichment centrifuges, changing their speed while showing operators normal readings. It spread via USB drives, exploiting several Windows zero-days. It is considered the first true cyberweapon against physical plants.

Exorcism

Cast it out by controlling removable media in plants and truly separating industrial networks. Readings shown by control systems should be checked against independent measurements.

Technical record

Also known as: W32.Stuxnet
Circle: Circle V · State espionage · Circle I · Worms
First seen: c. 2010
Status: Dormant
Weapons (exploited CVEs): Saint Stuxnet LNK
Works: The Scourge of Stuxnet

A sophisticated worm discovered in June 2010 that targeted Siemens Step7 software and PLCs controlling Iranian uranium-enrichment centrifuges, subtly altering their speed while hiding its changes. It spread via USB drives using several Windows zero-days and stolen code-signing certificates. It is widely reported as a joint US-Israeli operation and was the first known cyberweapon to cause physical destruction.

Sources: attack.mitre.org · en.wikipedia.org · MITRE ATT&CK reference S0603