The episode describes the Stuxnet incident as an attack involving the Stuxnet malware.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“This episode is about Stuxnet, the most sophisticated piece of malware to ever be discovered.”
Malware
malware:stuxnet
Also: Stuxnet virus, Stuxnet worm
Highly sophisticated malware designed to sabotage industrial control systems and Iranian centrifuges.
Highly sophisticated malware designed to sabotage industrial control systems and Iranian centrifuges.
“This episode is about Stuxnet, the most sophisticated piece of malware to ever be discovered.”
“They used a worm and because of that, they would infect any Windows system that Stuxnet encountered.”
Malware attack cited as a possible motive for retaliation against Iran’s nuclear facilities.
“some security researchers believe this was a retaliation from Iran because of the Stuxnet attack that hit their nuclear facilities.”
“Seeing things like Stuxnet leak and the US denying it”
Malware referenced as a US attack on Iranian soil and discussed as a possible context for Iran’s response.
“Stuxnet was a US attack on Iranian soil.”
Malware cited as an example of the power of highly resourced state-developed cyber weapons.
“Stuxnet proved just how powerful a virus can be if developed by the right people”
Malware mentioned as an example of a destructive cyber operation that the US government has not publicly acknowledged conducting.
“like with Stuxnet but the thing is, is the US has never admitted to doing Stuxnet.”
A malware example used to contrast attacks that directly interact with physical infrastructure with NotPetya’s disruption through digital systems.
“these attacks that directly interact with physical infrastructure like Stuxnet.”
Malware mentioned as having targeted a nuclear enrichment facility in Iran.
“We’ve seen Stuxnet try to disable a nuclear enrichment facility”
Malware described as having been used in the cyberattack against Iran's Natanz nuclear enrichment facility.
“Stuxnet was a cyber-attack which hit the Iranian nuclear enrichment facility in Natanz.”
Malware described as having affected Iranian nuclear centrifuges and demonstrating cyber effects in the physical world.
“What’s interesting is Lior was helping the Israeli intelligence units when Stuxnet was going on.”
“this virus or worm was not manually operated”
Malware mentioned as a possible successor or related operation to Flame in espionage against Iranian systems.
“Flame, which we believe was maybe the precursor to Stuxnet”
Malware discussed as the subject of a book found among Bini’s possessions and cited as evidence against him.
“I had a book about Stuxnet”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | centrifuge | Explicit | 29 |
| outgoing | USES | USB drive infection | Explicit | 29 |
| outgoing | USES | worm propagation | Explicit | 29 |
| outgoing | EXPLOITS | unknown Windows bug | Explicit | 29 |
| outgoing | AFFECTS | Microsoft Windows | Explicit | 29 |
| outgoing | EXPLOITS | SCADA software bug | Explicit | 29 |
| outgoing | AFFECTS | SCADA software | Explicit | 29 |
| outgoing | USES | digital certificate | Explicit | 29 |
| outgoing | USES | air gap | Explicit | 29 |
| outgoing | ATTRIBUTED_TO | United States | Explicit | 29 |
| outgoing | ATTRIBUTED_TO | United States | Explicit | 37 |
| outgoing | ATTRIBUTED_TO | Israel | Explicit | 29 |
| outgoing | ASSOCIATED_WITH | National Security Agency | Uncertain | 29 |
| outgoing | ASSOCIATED_WITH | Mossad | Uncertain | 29 |
| outgoing | ASSOCIATED_WITH | Central Intelligence Agency | Uncertain | 29 |
| outgoing | ASSOCIATED_WITH | Unit 8200 | Uncertain | 29 |
| outgoing | DISCOVERED_BY | Symantec | Explicit | 29 |
| outgoing | AFFECTS | Natanz | Explicit | 75 |
| outgoing | TARGETS | Iran | Explicit | 89 |
| incoming | INVOLVES | Stuxnet | Explicit | 29 |
| incoming | RELATED_TO | Shamoon | Uncertain | 30 |
| incoming | RELATED_TO | Flame | Uncertain | 98 |
The episode describes the Stuxnet incident as an attack involving the Stuxnet malware.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“This episode is about Stuxnet, the most sophisticated piece of malware to ever be discovered.”
Stuxnet AFFECTS centrifuge
Stuxnet damaged Iranian centrifuges by manipulating their operation.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“Stuxnet burrowed its way deep into a nuclear facility in Iran and destroyed its centrifuges”
Stuxnet USES USB drive infection
Stuxnet was distributed through infected USB sticks as a way to reach the air-gapped facility.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“USB sticks with the Stuxnet virus were spread”
Stuxnet USES worm propagation
A worm-based spreading mechanism was added so Stuxnet would infect Windows systems it encountered.
Explicit Confidence 99% · Kim Zetter EP 29 Details
“They used a worm and because of that, they would infect any Windows system that Stuxnet encountered.”
Stuxnet EXPLOITS unknown Windows bug
Stuxnet infected Windows machines by exploiting an unknown Windows bug.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“The malware would first have to infect a Windows machine to plant itself on it, which exploited an unknown Windows bug.”
Stuxnet AFFECTS Microsoft Windows
Stuxnet infected Microsoft Windows machines during its propagation.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“The malware would first have to infect a Windows machine to plant itself on it”
Stuxnet EXPLOITS SCADA software bug
After infecting a computer, Stuxnet altered SCADA software files by exploiting an unknown bug in that software.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“It would alter the files there, again exploiting an unknown bug in that SCATA software”
Stuxnet AFFECTS SCADA software
Stuxnet sought out and altered the SCADA software controlling the centrifuges.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“the virus can seek out the SCATA software that’s on that computer and this is the software that controls the centrifuges”
Stuxnet USES digital certificate
Stuxnet used an authentic digitally signed certificate to appear legitimate.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“the virus used an authentic digitally signed certificate to appear legitimate”
The operation had to account for Natanz computers being isolated from the internet by an air gap.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“the computers in Natanz were not reachable from the internet; they were air gapped”
Stuxnet ATTRIBUTED_TO United States
Kim Zetter directly attributes Stuxnet to the United States, although the episode also notes that the US never publicly confessed.
Explicit Confidence 92% · Kim Zetter EP 29 Details
“It was the US and Israel.”
Kim Zetter directly attributes Stuxnet to Israel, although the episode also notes that the operation was never publicly confessed.
Explicit Confidence 92% · Kim Zetter EP 29 Details
“It was the US and Israel.”
Stuxnet ASSOCIATED_WITH National Security Agency
The episode says the NSA probably crafted Stuxnet, but presents this as an uncertain assessment rather than a confirmed fact.
Uncertain Confidence 78% · Jack Rhysider EP 29 Details
“We think it was probably the NSA who crafted this virus”
Stuxnet ASSOCIATED_WITH Mossad
The episode says Israel’s Mossad likely attempted to place Stuxnet on computers used by Natanz personnel, but this is hedged.
Uncertain Confidence 72% · Jack Rhysider EP 29 Details
“the CSA or Israel’s Mossad likely tried to get it on the computers of the people working at the Natanz facility”
Stuxnet ASSOCIATED_WITH Central Intelligence Agency
The episode presents the CIA as possibly involved in earlier sabotage and intelligence collection connected to the Stuxnet operation.
Uncertain Confidence 78% · Jack Rhysider EP 29 Details
“The CIA were likely the ones introducing this faulty equipment into the facility”
Stuxnet ASSOCIATED_WITH Unit 8200
Unit 8200 was publicly suspected by news agencies, but Kim Zetter says the attribution is unclear and advises against pointing fingers at it.
Uncertain Confidence 90% · Kim Zetter EP 29 Details
“I wouldn’t point fingers at 8200.”
Stuxnet DISCOVERED_BY Symantec
Symantec researchers noticed, analyzed, and reported the Stuxnet malware after it spread beyond the intended target.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“security researchers from Symantec began noticing this virus and analyzing it and reporting about it”
Security researchers linked Shamoon's Saudi Aramco attack as possible retaliation for Stuxnet; this relationship is presented as uncertain.
Uncertain Confidence 75% · Jack Rhysider EP 30 Details
“this was a retaliation from Iran because of the Stuxnet attack that hit their nuclear facilities”
Stuxnet ATTRIBUTED_TO United States
Jack states that Stuxnet was a US attack on Iranian soil.
Explicit Confidence 96% · Jack Rhysider EP 37 Details
“Stuxnet was a US attack on Iranian soil”
Stuxnet was described as a cyberattack that hit Iran's Natanz nuclear enrichment facility.
Explicit Confidence 99% · Jack Rhysider EP 75 Details
“Stuxnet was a cyber-attack which hit the Iranian nuclear enrichment facility in Natanz.”
Jack describes Stuxnet as attacking an Iranian nuclear enrichment facility.
Explicit Confidence 99% · Jack Rhysider EP 89 Details
“this was an attack on an Iranian nuclear enrichment facility in order to thwart their enrichment process.”
Nicole says Flame may have been a precursor to Stuxnet, while presenting the relationship as uncertain.
Uncertain Confidence 90% · Nicole Perlroth EP 98 Details
“We discovered Flame, which we believe was maybe the precursor to Stuxnet”