Stuxnet
Stuxnet was a computer worm that destroyed uranium centrifuges at Iran's Natanz plant, the first cyberattack to damage physical equipment.
Stuxnet was a computer worm discovered in June 2010 that destroyed about 1,000 uranium enrichment centrifuges at Iran's Natanz nuclear facility. It was the first cyberattack known to cause physical damage to industrial equipment. The worm used four previously unknown Windows vulnerabilities, carried stolen digital certificates from two Taiwanese chip companies, Realtek and JMicron, and was designed to do nothing on almost every computer it infected. It activated only when it found the specific Siemens controllers that ran the centrifuges at Natanz. No government has officially claimed responsibility, but security researchers and journalists have identified Stuxnet as a joint operation by the United States and Israel, reportedly codenamed Olympic Games.
How Stuxnet found and destroyed Iran's centrifuges
Natanz was air-gapped: its control network had no connection to the internet. Stuxnet got past the air gap on USB drives. The worm spread harmlessly through ordinary Windows computers, copying itself from machine to machine, until someone brought a USB drive carrying it inside the facility.
Once inside, Stuxnet searched for one specific configuration: computers running Siemens Step 7 software that controlled the frequency converters driving centrifuge rotors. Uranium enrichment centrifuges spin at very high speeds to separate isotopes. They are mechanically delicate, and if the rotational speed moves outside a narrow safe range, the centrifuge destroys itself.
Stuxnet verified that the frequency converters matched the specific operating range of Iran's centrifuge models. Only then did it attack. It alternated between forcing the rotors to spin too fast and too slow. At the same time, it recorded what normal operations looked like and replayed those readings to the control room displays and the safety systems. Operators saw nothing wrong on their screens while centrifuges failed one after another.
For months, Iranian technicians pulled out broken centrifuges and installed new ones without finding the cause. They reportedly suspected defective parts, sabotage by employees, and supply chain problems before anyone suspected software. By the time the worm was identified, about 1,000 centrifuges had been destroyed out of roughly 9,000 installed at the plant.
How Stuxnet was discovered
The worm escaped because it was designed to spread. It turned up on about 100,000 computers worldwide, almost all of them unharmed, because it only attacked the specific Siemens setup at Natanz. In June 2010, a Belarusian antivirus firm called VirusBlokAda was asked to examine computers in Iran that kept crashing and rebooting. Its analysts, Sergey Ulasen and Oleg Kupreev, identified the malware on June 17, 2010. Researchers at Symantec and other security firms then spent months reverse-engineering it.
At about 500 kilobytes, Stuxnet was enormous by malware standards. Its four zero-day exploits, stolen digital certificates, and detailed knowledge of Siemens industrial controllers all pointed to a nation-state with vast resources and specific intelligence about the Natanz facility.
Who created Stuxnet?
Neither the United States nor Israel has officially acknowledged building Stuxnet. Security researchers and investigative journalists, including David Sanger of the New York Times, have concluded that the National Security Agency and Israel's military intelligence Unit 8200 built it together with support from the CIA and Israel's Mossad.
The operation reportedly began around 2006 under President George W. Bush. During the presidential transition, Bush urged President Barack Obama to continue the program, and Obama accelerated it. The strategic logic was direct: Israel considered Iran's nuclear program an existential threat and was prepared to launch airstrikes against it. An airstrike would have risked a regional war. A cyberattack that looked like a series of mechanical failures offered a way to delay the program while avoiding any open use of military force.
Did Stuxnet stop Iran's nuclear program?
No. The damage was real but short-lived. Iran replaced the damaged machines and expanded its enrichment capacity. By 2013, Iran had about 17,000 centrifuges at Natanz, roughly twice as many as when Stuxnet struck. The attack may have delayed the program by one to two years, but it did not end it.
What the delay may have done is create time for diplomacy. The Iran nuclear deal, reached in 2015, placed limits on Iran's enrichment program through negotiation rather than sabotage.
Cyberwarfare after Stuxnet
Almost every cyberattack before Stuxnet had targeted data or services. Stuxnet was the first to destroy industrial equipment. It showed that software could cause the kind of destruction that once required an airstrike, and it did so without any government claiming responsibility.
Its spread beyond the target gave every government's security researchers a working example of how to build a similar weapon. Industrial control systems became a standard target. In 2015 and 2016, Russian hackers shut down parts of Ukraine's power grid, cutting electricity to about 230,000 people in the first attack. In 2017, the NotPetya attack, also attributed to Russia, caused more than $10 billion in damage worldwide. Ransomware attacks against pipelines and hospitals are now common crimes that use techniques once available only to intelligence agencies.
The country that built the first weapon of this kind also has the most internet-connected infrastructure on earth. The United States pioneered a form of attack that its own power grids, pipelines, and hospitals are especially vulnerable to. Attribution of cyberattacks is slow, contested, and often deniable, which makes traditional deterrence difficult to apply. These are problems Stuxnet helped create, and none of them have been solved.