Stuxnet was a worm built to sabotage industrial control systems. Researchers first described it in mid 2010, yet Symantec later found a sample from June 2009. The lessons for defenders are practical: patch known flaws, control removable media, separate control networks and watch for changes to controller logic.
What is the sourced timeline?
We stick to facts in two sources we could fetch, and mark where they stop.
- June 2009. Symantec says it found a Stuxnet sample from June 2009 in its archive, so the attackers were active for at least a year before discovery. It adds that they may have started earlier (Symantec).
- Mid 2010. A Belarusian security firm, referred to as Virusblokada on Symantec's page, announced a new sample that used an unpatched vulnerability to spread to removable drives. Symantec's page gives no date for that announcement. Secondary sources place it in June 2010, and we did not confirm that from a primary source.
- 13 July 2010. Symantec says its own investigation began on July 13.
- 1 October 2010. Symantec posted its dossier.
- Late September 2010. ICS-CERT's advisory on Stuxnet was in place by then, noting it had issued earlier advisories and that its references were accessed on 28 September 2010 (CISA).
We are not asserting who built Stuxnet or what it hit. Symantec's page says the real-world target remained unknown at that time.
How did it spread and what did it do?
The ICS-CERT advisory says Stuxnet used four zero-day exploits, two of which had been patched by then. It also used a vulnerability exploited by Conficker (MS08-067), and could spread through infected USB devices, network shares, STEP 7 project files, WinCC database files and a print spooler flaw (MS10-061). It could be updated through command and control and peer-to-peer communication over RPC.
Its target was Siemens SIMATIC WinCC and STEP 7 software. Symantec states that its ultimate goal was to sabotage an industrial control system.
What should defenders learn?
Air gaps are not a control by themselves. The worm spread on removable drives and project files, which is how data crosses a gap. Treat media and engineering laptops as part of the attack surface.
Patch old flaws. The advisory lists a flaw from 2008 among the methods. Unpatched systems on control networks are a standing risk.
Protect engineering workstations. Project files were a propagation route. Restrict who can open and share them, and scan them.
Monitor controller changes. The advisory lists indicators such as malicious files in project subdirectories. Baseline controller logic and alert on unexpected changes.
Limit trust in signed code. We did not confirm the certificate details in our sources, so we skip them, but the general point stands: signature checks are one signal, not proof.
Segment and log. Separate control from business networks, restrict peer-to-peer traffic and keep logs that let you investigate.
Prepare impact analysis. ICS-CERT advised performing impact analysis and risk assessment before taking defensive steps. In a plant, a response can itself cause harm.
Why does it matter for software supply chains?
Stuxnet shows that trusted channels, such as project files and installers, can carry hostile code. Today's equivalent is a poisoned dependency or build artifact. An inventory of what runs in your environment, including engineering tools, is the starting point.
What to do
- Inventory controllers, engineering workstations and the software on them.
- Patch or isolate systems with known flaws, and record exceptions.
- Control removable media with a scan station and an allow list.
- Restrict who can open and share project files, and scan them.
- Baseline controller programs and alert on changes.
- Segment control networks and log traffic crossing the boundary.
- Write and rehearse an impact analysis step into your response plan.
Quick check
Did Stuxnet use only one vulnerability?
No. ICS-CERT reported four zero-day exploits, two already patched at the time, plus older flaws including MS08-067 and the print spooler flaw MS10-061.
Who built Stuxnet?
We cannot say from the sources we fetched. Symantec's page says the real-world target was unknown at the time of writing.
Sources
Last reviewed: 18 October 2026.
