Stuxnet

What is Stuxnet?

Stuxnet is a computer worm that reprogrammed Siemens PLCs to sabotage the uranium centrifuges at Iran’s Natanz enrichment plant, making it the first known digital weapon to cause physical damage to an industrial installation. The malware was discovered in June 2010 by the Belarusian antivirus company VirusBlokAda, but by then it had already been active for years. Its name comes from two keywords in the code: .stub and mrxnet.sys. For anyone working with industrial control systems, Stuxnet is the textbook example of what happens when an attacker takes over the process control itself.

Stuxnet marks the start of the “cyber-physical era”, in which digital attacks have a direct impact on physical processes.

🕰️ How did the Stuxnet campaign unfold?

Stuxnet was not a one-off action but a campaign spanning years and several versions:

By the end of September 2010, Symantec counted roughly 100,000 infected computers in more than 155 countries, around 60% of them in Iran. The infections trace back to five organisations with a presence in Iran, most likely suppliers and contractors to the nuclear programme. Through their laptops and USB drives, the worm reached the isolated facility.

🔧 How did Stuxnet work technically?

Stuxnet combined an unprecedented number of techniques in a single package of about half a megabyte:

• Four Windows zero-days - a flaw in shortcut handling (MS10-046), a flaw in the print spooler (MS10-061) and two privilege escalation vulnerabilities (MS10-073 in the win32k.sys keyboard layout handling and MS10-092 in Task Scheduler). The worm also exploited the older MS08-067 flaw, which Conficker had used as well.
• Stolen certificates - the drivers were signed with private keys belonging to the Taiwanese companies Realtek and JMicron. Windows therefore trusted the drivers as legitimate software, undermining code signing as the only anchor of trust.
• Spreading via USB and project files - the worm copied itself to USB drives, network shares and Step 7 project files (.s7p). That is how it jumped the air gap, without ever needing an internet connection to the plant.
• Abuse of WinCC - a hard-coded password for the WinCC database was used to infect other SCADA servers.
• A PLC rootkit - on the engineering station, Stuxnet replaced the Step 7 communication library s7otbxdx.dll. Every read or write to the PLC therefore passed through the attacker’s code, which injected its own code blocks into the PLC and hid them from the engineer reading out the program.
• Fingerprinting the target - the sabotage code only activated on an S7-315-2 CPU with Profibus communication processors (CP 342-5) driving frequency converters made by Vacon (Finland) or Fararo Paya (Iran). On every other system Stuxnet did nothing harmful.

An important detail: Stuxnet did not alter the PLC’s firmware but its application logic (the organisation blocks OB1 and OB35). That makes the attack relevant to any installation where project files and engineering software are poorly protected.

🏭 How did Stuxnet sabotage the centrifuges?

Version 1.x targeted the centrifuge motors. Normally, the frequency converters ran between 807 and 1,210 Hz, with 1,064 Hz as the nominal speed of the IR-1 centrifuge. Stuxnet first observed the process for about thirteen days, then raised the frequency to 1,410 Hz for roughly fifteen minutes before returning it to 1,064 Hz. About 27 days later came the opposite step: a 2 Hz setpoint that sharply slowed the rotors for around fifty minutes, after which the frequency went back to 1,064 Hz and the cycle started again. These extreme accelerations and decelerations put mechanical stress on the rotors, so centrifuges failed earlier without it looking like an obvious attack.

The older version 0.5 took a different route: on the S7-417 CPUs of the cascade protection system, the code closed valves so that the pressure inside the centrifuges rose. During that attack, Stuxnet played back previously recorded, normal sensor values to the control room, a classic replay attack. Operators at the HMI therefore saw a calm process while the installation was being damaged.

🧠 Why was Stuxnet unique?

Stuxnet differs from ordinary malware in three ways:

• Precision targeting - the attackers knew the exact process design: CPU type, number of drives per Profibus segment, drive brands and frequency range. That requires detailed knowledge of the installation and probably a test rig with real centrifuges.
• Sabotage rather than theft - the goal was not data but slowing down a physical process while the victim blamed engineering or material problems.
• Nation-state resources - four zero-days, stolen certificates and years of preparation point to a state actor. Major media attribute the operation, code-named Olympic Games, to the United States and Israel. Neither country has ever officially confirmed this.

There is also a Dutch angle. According to investigative journalism published in 2019 and 2024, Dutch intelligence helped get the malware into the plant, partly through a Dutch engineer working in Iran. That, too, has never been officially confirmed.

🔄 Which attacks followed Stuxnet?

Stuxnet is still regarded as the blueprint for OT attacks. Some successors share code, others only the approach:

These attacks target energy, water, oil and gas and other critical infrastructure. The pattern is the same every time: access via IT, knowledge of the process, and manipulation of the control system.

🔐 What lessons can you draw from Stuxnet?

Stuxnet shows that an air gap alone is not security. Measures that follow directly from the attack:

🧭 How do you apply Stuxnet’s lessons to your own plant?

A practical approach in five steps:

1. Map the engineering chain - which laptops, engineering stations and project files can change PLC logic, and who has access to them?
2. Restrict removable media - allow only scanned and registered USB drives, ideally through a fixed scanning station at the entrance to the OT environment.
3. Monitor PLC code integrity - periodically compare the program in the PLC with an approved baseline, and where possible leave the CPU key switch in RUN rather than a programming mode.
4. Segment according to IEC 62443 - separate the engineering, SCADA and office networks into zones with controlled conduits, in line with the Purdue Model.
5. Design for the worst case - make sure a manipulated controller cannot reach an unsafe state, for example with an independent SIS or a mechanical speed limit.

In the Netherlands this is no longer optional. The Cybersecurity Act (the Dutch implementation of NIS2) has applied since 15 August 2026 and requires essential and important entities to manage risks, including in OT. Suppliers and contractors explicitly fall under supply chain risks, exactly the route Stuxnet used.

❓ Frequently asked questions

When was Stuxnet discovered?

Stuxnet was discovered in June 2010 by the Belarusian company VirusBlokAda. Later analysis showed that an earlier version, Stuxnet 0.5, was already active in November 2007 and that its infrastructure was set up in 2005.

How much damage did Stuxnet cause?

Stuxnet infected around 100,000 computers but only caused damage at Iran’s Natanz enrichment plant. Estimates point to about 1,000 centrifuges replaced between late 2009 and early 2010, roughly ten per cent of the installed capacity.

Is Stuxnet still dangerous?

Stuxnet itself is no longer dangerous: the worm stopped spreading on 24 June 2012 and the Windows flaws it exploited have been patched. Its approach remains highly relevant, however, because attackers reuse the same ideas of PLC manipulation and operator deception in newer malware.

Were organisations outside Iran affected by Stuxnet?

Stuxnet infected computers in more than 155 countries, and in the first months Siemens found the worm at more than twenty customers. Stuxnet caused no damage there, because the specific combination of PLC, Profibus cards and frequency converters was missing.

Can an air gap stop an attack like Stuxnet?

An air gap alone cannot stop an attack like Stuxnet, because the worm spread through contractors’ USB drives and Step 7 project files. Protection additionally requires a removable media policy, control of engineering stations and monitoring of PLC code.

Who was behind Stuxnet?

Media reports and research attribute Stuxnet to a joint operation by the United States and Israel, code-named Olympic Games. Neither country has officially acknowledged it, and a reported Dutch role has never been confirmed either.

📌 In summary

Stuxnet proved that a cyberattack can sabotage a physical process by changing PLC logic while showing operators normal values. The worm jumped the air gap via USB and project files, used four zero-days and stolen certificates, and shaped how OT security is organised today: segmentation, removable media control, PLC code integrity and designing for the worst case.