ICS / nation-stateATT&CK S0603
Stuxnet
Also known as: W32.Stuxnet
Stuxnet, discovered in 2010, was the first widely known malware built to cause physical damage through industrial control systems. It spread through Windows networks and USB drives to find computers running Siemens Step 7 engineering software, then altered the code on specific PLCs while showing operators normal values.
- Public attribution and associated actors
- No government has publicly claimed responsibility. This page makes no attribution.
- First seen
- 2010
- Platforms
- Windows, Siemens Step 7 / S7 PLCs
- MITRE ATT&CK software entries
- S0603 Stuxnet
How it spreads or gets in
- Spread through USB drives to reach air-gapped networks, then through network shares and vulnerable Windows services (CISA ICSA-10-201-01C).
Key behaviours
- Used stolen code-signing certificates and a rootkit to hide.
- Exploited Windows vulnerabilities to raise privileges.
- Downloaded modified logic to targeted PLCs and changed process parameters while masking the change from operators.
ATT&CK techniques
- T1091Replication Through Removable Media
- T1210Exploitation of Remote Services
- T1068Exploitation for Privilege Escalation
- T1553.002Subvert Trust Controls: Code Signing
- T1014Rootkit
- T0843Program Download
- T0836Modify Parameter
- T0832Manipulation of View
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Monitor engineering workstations for unexpected PLC program downloads.
- Compare running PLC logic with known-good baselines.
- Log and control USB use on OT networks.
Defences that work
- Control removable media in OT environments with scanning kiosks and device control.
- Segment OT from IT following a zone and conduit model (IEC 62443).
- Use PLC key switches or write protection and verify logic integrity.
- Check physical process values independently of the HMI.