Stuxnet Technical Intelligence Dossier

Executive Summary & Threat Architecture

Stuxnet is widely recognized in military and cybersecurity history as the world's first true cyber weapon, uncovered in June 2010 by VirusBlokAda and subsequently determined to be the product of Operation Olympic Games, a joint intelligence operation by the United States and Israel. Explicitly engineered to physically sabotage the uranium enrichment centrifuges at the heavily guarded, air-gapped Natanz nuclear enrichment facility in Iran, Stuxnet achieved unprecedented technical sophistication that permanently transformed military doctrine and critical infrastructure security. To infiltrate the strictly air-gapped facility, Stuxnet was introduced via infected USB flash drives, weaponizing four separate Windows zero-day vulnerabilities in a single payload: the infamous Windows Shell LNK icon handling vulnerability (CVE-2010-2568), the Server Service RPC buffer overflow (CVE-2008-4250 / MS08-067), the Print Spooler service elevation flaw (CVE-2010-2729), and a Win32k.sys true-type font vulnerability. The worm was signed with stolen digital certificates from legitimate semiconductor hardware manufacturers Realtek and JMicron to bypass driver signature verification. Once inside a network, Stuxnet quietly mapped the environment, specifically searching for Siemens SIMATIC Step7 PLC (programmable logic controller) software controlling S7-300 and S7-400 systems managing frequency converter drives. Stuxnet covertly intercepted and modified PLC ladder logic code: it forced targeted centrifuge rotors to violently speed up to 1,410 Hz (far beyond their rated design tolerance) and then slow down to 2 Hz, inducing catastrophic mechanical stress and destroying approximately 1,000 centrifuges, while simultaneously spoofing normal operational sensor readings to control room monitors.

Observed Threat Aliases: Rootkit.Win32.Stuxnet, W32.Stuxnet, Operation Olympic Games, Stuxnet Industrial Worm

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: olympic_games_framework

Documented Downstream Variants: stuxnet_0.5, stuxnet_1.0, duqu_relative, flame_relative

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by Stuxnet operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Removable USB flash drive propagation exploiting Windows LNK shortcut parsing flaw CVE-2010-2568
• Network propagation across internal subnets exploiting MS08-067 NetAPI flaw CVE-2008-4250 and Print Spooler

Host Persistence & Execution Hooks

• Signed kernel-mode device driver installation using stolen Realtek and JMicron certificates
• SSDT hooking in kernel memory to hide .LNK and temporary files on removable media

Reference File Hashes (SHA-256)

• 5b508f72a4209bf26efba098b671a52028ddc87c14a22ad31737be70d8a57102
• a172776c59b67195721118182969b761a17387f5df2307ef086915091219b671