An unknown security researcher has published a reverse-engineered reconstruction of the source code for Stuxnet, the infamous malware that targeted Iranian nuclear facilities in the early 2010s. The repository is now available on GitHub, allowing interested technical users to examine the inner workings of the software.
Stuxnet is widely believed to be the first digital worm to cause direct physical damage. Its ultimate target was industrial controllers from Siemens reportedly used in Iran’s Natanz nuclear enrichment plant. Once inside the system, the malware manipulated frequency converters in industrial centrifuges to subtly damage rotors while reporting normal operation to plant staff.
The published repository includes build instructions for those wishing to study the code. To run it safely, users require a Windows XP or Windows 7 virtual machine with no network connectivity configured. While basic spreading mechanisms can be observed without additional hardware, witnessing the full effects of the payload requires appropriate Siemens software and ideally the corresponding hardware.
During its active period, Stuxnet spread via three primary mechanisms. The main infection vector involved USB sticks containing Windows shortcuts and autorun.inf files; simply viewing the drive's contents triggered infection due to a zero-day vulnerability. Infected systems then attempted to spread autonomously across networks using a zero-day Windows Print Spooler vulnerability, which allowed attackers to write system files to any machine sharing a printer. The worm also copied itself to accessible network shares and used two stolen digital certificates from Realtek and JMicron to evade Windows driver signature checks.
Additionally, Stuxnet contained code to inject itself into Siemens software via the WinCC SQL Server database and by embedding malicious code in Step 7 project files. These files were automatically executed when engineers opened them, facilitating internal spread among multiple users without requiring control over network shares. The final stage involved taking charge of the DLL communicating with centrifuges and injecting malicious code into Programmable Logic Controllers (PLCs) to alter rotor operations.
Stuxnet was part of Operation Olympic Games, an alleged coordinated effort between the U.S. and Israel aimed at curbing Iran’s purported progress in creating nuclear weapons. The initiative reportedly ran under both the Bush and Obama administrations and was allegedly developed by the Pentagon and Israel’s Unit 8200. It is reported to have successfully damaged approximately 10% of Natanz’s centrifuges.
However, the worm contained a significant bug: it lacked sufficient environmental checks and failed to recognize when it had left a local network environment. When engineers took their laptops home, the malware escaped to the internet, prompting investigation by security researchers worldwide. The worm included a hard-coded self-destruct date set for June 24, 2012.
