Stuxnet was malware that altered the code of Siemens programmable logic controllers to change how industrial equipment physically ran, while showing operators normal readings. Publicly uncovered in June 2010, it reached isolated networks on infected USB drives. It showed that software could damage machinery directly.
What it targeted
Stuxnet looked for Siemens Step 7 and WinCC software and S7 PLCs. Its payload was aimed at Iran's uranium enrichment program, most likely gas centrifuges at Natanz. It only acted on systems with specific variable frequency drives and motors in a narrow frequency band, and it stayed dormant if Step 7 was absent.
Development is believed to date back to at least 2005, and a first variant appeared in 2009. It used four zero day flaws.
How it moved
Infected USB flash drives were the usual way in, which is how it crossed the air gap. Inside a network it spread through other exploits and remote procedure calls.
What made it different
It manipulated PLC logic and changed motor frequencies, then intercepted communication between the engineering software and the controller to hide the changes. It also fed operators normal looking values and spoofed sensor signals so the system would not shut down.
The Institute for Science and International Security estimated it may have destroyed up to about 1,000 centrifuges, roughly 10 percent. The worm infected over 200,000 computers. Neither the US nor Israel has officially admitted responsibility, though multiple news organisations report a joint effort.
Lessons
An air gap is not absolute. Removable media is an entry point. Control USB use and scan media on a separate station.
Patch known flaws. It used weaknesses in Siemens systems that had been publicised in 2008.
Audit the controllers, not only Windows. Cleaning a PC may not remove changes in a PLC.
Do not rely only on what operators see. If the screen can be lied to, independent measurement matters. A separate vibration sensor or a hardwired limit does not take its reading from the same compromised path.
Layer defences. Segmentation, access control, patching, monitoring and risk assessment together.
A note on tone: one analysis in the source suggests that destroying equipment through a cyberattack may be harder than often believed. Both claims can hold. Stuxnet was real and expensive to build.
The link to safety design
If a software attack can both change the process and mask its effect, a safety layer sharing that software path offers little protection. Independent hardware protections, such as mechanical relief valves and hardwired trips, are valuable because malware cannot talk them out of acting. Read our explainer on independence in safety systems.
Quick check
Who built Stuxnet?
No government has officially claimed it. News organisations report a joint US and Israeli operation, which the sources describe as unconfirmed officially.
Could it hit ordinary office PCs?
It infected many computers but only attacked systems with specific Siemens software and equipment configurations.
Sources
A secondary summary; I read the first part of a long page.
Last reviewed: 19 October 2026.
