Anonymous researcher publishes reconstructed Stuxnet source code on GitHub
An unknown security researcher has reverse-engineered the Stuxnet worm's source code and published it, including build instructions. The malware famously targeted Iranian nuclear centrifuges and caused physical damage. It's advised to run in isolated VM.
The worm utilized three distinct propagation methods, exploiting a USB shortcut flaw and a Print Spooler vulnerability, while bypassing driver checks with certificates stolen from Realtek and JMicron. It also hid inside Siemens project files to spread among engineers.
Its final payload hijacked the communication DLL to manipulate Programmable Logic Controllers, subtly altering centrifuge speeds to damage rotors while masking the changes. The published repository includes build instructions, though observing the full destructive effect requires specialized industrial equipment, making it mostly an educational resource.
The public release of this reconstructed code could significantly lower the barrier for understanding advanced cyber-physical attacks. While it may primarily serve as a learning tool for security researchers and industrial defenders, it also provides a blueprint that malicious actors could potentially adapt for targeting other critical infrastructure. Operators of legacy industrial systems may face increased scrutiny and pressure to patch vulnerabilities, though the specific hardware requirements limit immediate widespread threats.