Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
Stuxnet ASSOCIATED_WITH Central Intelligence Agency
The episode presents the CIA as possibly involved in earlier sabotage and intelligence collection connected to the Stuxnet operation.
Uncertain Confidence 78% · Jack Rhysider EP 29 Details
“The CIA were likely the ones introducing this faulty equipment into the facility”
Stuxnet ATTRIBUTED_TO United States
Kim Zetter directly attributes Stuxnet to the United States, although the episode also notes that the US never publicly confessed.
Explicit Confidence 92% · Kim Zetter EP 29 Details
“It was the US and Israel.”
Kim Zetter directly attributes Stuxnet to Israel, although the episode also notes that the operation was never publicly confessed.
Explicit Confidence 92% · Kim Zetter EP 29 Details
“It was the US and Israel.”
Kim Zetter AUTHORED Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon
Kim Zetter identifies herself as the author of Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon.
Explicit Confidence 99% · Kim Zetter EP 29 Details
“I’m the author of Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon.”
The Stuxnet operation penetrated the Natanz nuclear facility network and infected systems there.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“When the contractor with the infected computer went into the facility the virus spread all through the network”
Stuxnet DISCOVERED_BY Symantec
Symantec researchers noticed, analyzed, and reported the Stuxnet malware after it spread beyond the intended target.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“security researchers from Symantec began noticing this virus and analyzing it and reporting about it”
Stuxnet EXPLOITS SCADA software bug
After infecting a computer, Stuxnet altered SCADA software files by exploiting an unknown bug in that software.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“It would alter the files there, again exploiting an unknown bug in that SCATA software”
Stuxnet EXPLOITS unknown Windows bug
Stuxnet infected Windows machines by exploiting an unknown Windows bug.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“The malware would first have to infect a Windows machine to plant itself on it, which exploited an unknown Windows bug.”
Stuxnet INITIAL_ACCESS_VIA USB drive infection
The attackers attempted to overcome Natanz’s air gap by placing Stuxnet on USB sticks and getting them into the facility.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“the attackers came up with the idea of putting the virus on a USB stick”
The episode describes the Stuxnet incident as an attack involving the Stuxnet malware.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“This episode is about Stuxnet, the most sophisticated piece of malware to ever be discovered.”
Stuxnet INVOLVES International Atomic Energy Agency
IAEA inspectors visited Natanz and their reports provided evidence about centrifuge problems and the facility’s condition.
Explicit Confidence 98% · Kim Zetter EP 29 Details
“They started visiting Natanz a couple of times a month and they would write reports”
Stuxnet INVOLVES Oak Ridge National Laboratory
Oak Ridge National Laboratory was described as building centrifuge replicas and developing methods to damage them.
Explicit Confidence 96% · Jack Rhysider EP 29 Details
“out at Oakridge National Laboratory, they built a replica of the Natanz facility”
Stuxnet INVOLVES Idaho National Laboratory
Idaho National Laboratory was associated with the operation because of its industrial-control-system expertise, though the episode hedges that it may have assisted.
Uncertain Confidence 88% · Jack Rhysider EP 29 Details
“They may have received help from scientists at the Idaho Lab too”
Stuxnet INVOLVES centrifuge
The incident involved the destruction and malfunction of centrifuges at Natanz.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“there were around 1,000 less working centrifuges compared to the last report”
The Stuxnet attack targeted Iran.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“Stuxnet burrowed its way deep into a nuclear facility in Iran”
Stuxnet USES USB drive infection
Stuxnet was distributed through infected USB sticks as a way to reach the air-gapped facility.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“USB sticks with the Stuxnet virus were spread”
The operation had to account for Natanz computers being isolated from the internet by an air gap.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“the computers in Natanz were not reachable from the internet; they were air gapped”
Stuxnet USES worm propagation
A worm-based spreading mechanism was added so Stuxnet would infect Windows systems it encountered.
Explicit Confidence 99% · Kim Zetter EP 29 Details
“They used a worm and because of that, they would infect any Windows system that Stuxnet encountered.”
Stuxnet USES digital certificate
Stuxnet used an authentic digitally signed certificate to appear legitimate.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“the virus used an authentic digitally signed certificate to appear legitimate”
Shamoon AFFECTS master boot record
Shamoon destroyed the master boot record, preventing affected computers from restarting normally.
Explicit Confidence 98% · Chris Kubecka EP 30 Details
“you lost your master boot record so you couldn’t immediately pull everything back up”
exploit of unpatched Microsoft Word or Adobe Acrobat vulnerabilities AFFECTS Adobe Acrobat
The exploit concerned known vulnerabilities in older versions of Adobe Acrobat.
Explicit Confidence 95% · Jack Rhysider EP 30 Details
“an older version of Microsoft Word or Adobe Acrobat that has known vulnerabilities”
exploit of unpatched Microsoft Word or Adobe Acrobat vulnerabilities AFFECTS Microsoft Word
The exploit concerned known vulnerabilities in older versions of Microsoft Word.
Explicit Confidence 95% · Jack Rhysider EP 30 Details
“an older version of Microsoft Word or Adobe Acrobat that has known vulnerabilities”
Saudi Aramco cyber-attack (2012) ASSOCIATED_WITH The Cutting Sword of Justice
The Pastebin warnings connected with the attack were signed by The Cutting Sword of Justice; the transcript does not establish that the group conducted the attack.
Explicit Confidence 96% · Jack Rhysider EP 30 Details
“The Pastebin was signed by someone calling themselves The Cutting Sword of Justice”
Iranian Cyber Army ASSOCIATED_WITH Islamic Revolutionary Guard Corps
Rumors said the Iranian Cyber Army was started by the IRGC; the episode treats this as unconfirmed.
Uncertain Confidence 82% · Jack Rhysider EP 30 Details
“rumors say it was started by the IRGC”
Saudi Aramco cyber-attack (2012) ATTRIBUTED_TO Iran
The Saudi Arabian government attributed the attack to Iran.
Attributed Confidence 96% · Chris Kubecka EP 30 Details
“According to the Saudi Arabian government, it was the country of Iran.”