Stuxnet was a specialized cyber-physical weapon built around Windows propagation, Siemens Step7/WinCC engineering environments, and malicious programmable-logic-controller code. Public U.S. reporting attributed the Olympic Games program to U.S.-Israeli intelligence, while CISA, MITRE, Symantec/Broadcom, Langner, and Institute for Science and International Security material trace how the malware moved through engineering systems, manipulated S7 controllers, and was linked to damage at Iran's Natanz centrifuge plant.
Open technical sources describe Stuxnet as a chain from Windows infection to Siemens engineering software, then to PLC code that changed centrifuge-related behavior while trying to hide the change from operators. The evidence is strongest at the component and process level: propagation, Step7/WinCC compromise, S7 controller manipulation, and Natanz impact assessments.
Windows hosts, removable media, network shares, RPC updating, and Step7 project files carried the malware toward engineering systems.
Supported by CISA, MITRE ATT&CK, and Symantec/Broadcom.
The technical literature identifies Siemens S7 controller payloads, including S7-315 drive manipulation and S7-417 cascade-protection manipulation.
Supported by Langner's technical analysis and ISIS Natanz assessments.
Open-source assessments connect the malware to damaged Natanz IR-1 centrifuges, but public sources still leave uncertainty about exact effect size and official state responsibility.
Supported by ISIS and attribution reporting.
Public technical sources separate Stuxnet by function and observed development phase rather than by an official family of fielded variants.
| Variant | Configuration | Designation notes |
|---|---|---|
| Stuxnet dropper and Windows propagation layer | Windows infection and spread component | CISA, MITRE, and Symantec/Broadcom describe the Windows-side malware using removable media, network propagation, rootkit techniques, command-and-control reporting, and Step7 project infection before a matching industrial-control environment was reached. Sources: CISA Primary Stuxnet Advisory, MITRE ATT&CK Stuxnet, W32.Stuxnet Dossier |
| S7-315 rotor-speed attack | Centrifuge drive manipulation payload | Langner's technical analysis identifies an S7-315 branch aimed at centrifuge drive systems by manipulating rotor speeds through frequency-converter control logic. Sources: Langner To Kill a Centrifuge |
| S7-417 overpressure attack | Cascade protection manipulation payload | Langner describes an earlier, more complex S7-417 payload that targeted the Cascade Protection System, replayed recorded process values, and manipulated valves and pressure readings in a Natanz cascade context. Sources: Langner To Kill a Centrifuge |
MITRE records Stuxnet as discovered in 2010 but notes that some components were in use as early as November 2008.
Sources: MITRE ATT&CK Stuxnet
Institute for Science and International Security assessed that Stuxnet may have destroyed about 1,000 IR-1 centrifuges at Natanz in late 2009 or early 2010.
Sources: ISIS Natanz Stuxnet Assessment, ISIS Natanz Stuxnet Update
Security companies began reporting the worm in June 2010, prompting official industrial-control-system mitigation guidance.
Sources: CISA Stuxnet Malware Mitigation
CISA's primary advisory described malware targeting Siemens control software and noted the use of four zero-day exploits.
Sources: CISA Primary Stuxnet Advisory
Symantec/Broadcom announced the W32.Stuxnet Dossier after weeks of analysis, covering infection statistics, propagation, command-and-control behavior, and the PLC infector.
Sources: Symantec Stuxnet Dossier Announcement, W32.Stuxnet Dossier
Institute for Science and International Security said later information increased the likelihood that the S7-315-focused part of Stuxnet caused Natanz centrifuge damage, while noting that the attack did not stop Iran's enrichment program.
Sources: ISIS Natanz Stuxnet Update
The Washington Post reported that current and former officials described Olympic Games as a collaborative NSA, CIA and Israeli effort against Iranian centrifuges at Natanz.
Sources: Washington Post Stuxnet U.S. Israeli experts
Ralph Langner's To Kill a Centrifuge separated the Natanz attack into a complex S7-417 overpressure path and a later S7-315 rotor-speed path.
Sources: Langner To Kill a Centrifuge
