Skip to main content
OT Atlas
Search

2010 (discovered) · Nuclear enrichment

Stuxnet

Malware that targeted specific Siemens control configurations and manipulated the process while presenting normal values to operators. Widely regarded as the first publicly analysed malware built to cause physical effects.

Direct OT impactIran (primarily)

What happened

Highly targeted malware propagated via removable media and network shares, checked for a very specific controller and drive configuration, and modified controller logic while replaying recorded process values to the operator view.

Who

Publicly attributed by many researchers and journalists to a state-sponsored operation; no formal government acknowledgement of authorship.

Where

Industrial facilities, with the notable target set in Iran.

Why

Assessed objective: degrade a specific industrial process without an overt kinetic operation.

How

Initial access via removable media into an isolated environment, propagation using multiple Windows vulnerabilities, then abuse of engineering software components to reach and modify controller logic. Specifically, it replaced the STEP 7 library that mediates every exchange between the engineering software and the controller, so the engineer's upload showed the original blocks while the CPU ran the attacker's. The defensive lesson is on the Siemens vendor page: online-versus-offline comparison from an independent, known-good engineering host, S7 CPU protection levels, and restriction of 102/TCP to named engineering hosts.

Timeline

  1. 2007–2009Variants developed and deployed (per subsequent research)
  2. June 2010Samples identified by antivirus researchers
  3. Late 2010Detailed public analysis of the controller-manipulation payload

Attack path

Described at the level required to build detection and controls.

Initial Access

Reported

Removable media introduced into the environment

Propagation

Reported

Windows exploitation and network shares

Engineering environment

Reported

Abuse of engineering software libraries

Control systems

Reported

Modified controller logic

Physical consequence

Assessed

Equipment operated outside intended parameters

Impact

OT impactController logic was modified to alter drive behaviour outside normal operating parameters.
Safety impactNo publicly documented personnel harm; the operation targeted equipment behaviour.
Operational impactEquipment degradation and disrupted process output over an extended period.
Detected byAntivirus research following incident reports, not by OT monitoring at the affected sites.

Technology involved

Windows engineering hostsSiemens STEP 7 engineering software (the s7otbxdx.dll interception point)Siemens S7-300/S7-400 controllers speaking S7comm on 102/TCPSiemens and Vacon variable frequency drives at specific frequency ranges

ATT&CK techniques

T0862T0843T0836T0856

Vulnerabilities and weaknesses exploited

  • Multiple Windows vulnerabilities used for propagation (patched long ago)

Control failures

  • Removable media controls
  • Engineering software integrity assumptions
  • Reliance on air-gap as a control
  • No independent verification of controller logic

Where earlier detection was possible

  • Controller logic baselining and periodic comparison
  • Removable media controls and monitoring on engineering hosts
  • Cross-checking process indications against independent instrumentation

Defensive lessons

  • Air-gaps degrade in practice; removable media and engineering laptops cross them
  • Operator view can be manipulated — independent verification matters
  • Engineering software is a control-system attack path, not just an IT application

Why should I care?

Case studies are only useful if they change something. Pick one lesson above and check whether the control exists in your own environment this week.

Sources & further reading