Episode
02 January 2019 Official episode · Official transcript
advanced persistent threat
The episode examines Stuxnet, its sabotage of Iranian centrifuges at Natanz, the malware’s discovery and technical sophistication, and reported attribution to a joint US-Israeli operation.
Topics: Industrial control system sabotage, Nuclear centrifuge control, SCADA software, Air-gapped networks, USB-based malware delivery, Worm propagation, Zero-day vulnerabilities, Digitally signed certificates and stolen private keys, Monitoring-system deception, Cyber-physical effects, State-sponsored cyber operations, Malware discovery and attribution
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Kim Zetter AUTHORED Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon
Kim Zetter identifies herself as the author of Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon.
Explicit Confidence 99% · Kim Zetter EP 29 Details
“I’m the author of Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon.”
The episode describes the Stuxnet incident as an attack involving the Stuxnet malware.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“This episode is about Stuxnet, the most sophisticated piece of malware to ever be discovered.”
The Stuxnet attack targeted Iran.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“Stuxnet burrowed its way deep into a nuclear facility in Iran”
The Stuxnet operation penetrated the Natanz nuclear facility network and infected systems there.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“When the contractor with the infected computer went into the facility the virus spread all through the network”
Stuxnet AFFECTS centrifuge
Stuxnet damaged Iranian centrifuges by manipulating their operation.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“Stuxnet burrowed its way deep into a nuclear facility in Iran and destroyed its centrifuges”
Stuxnet INVOLVES centrifuge
The incident involved the destruction and malfunction of centrifuges at Natanz.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“there were around 1,000 less working centrifuges compared to the last report”
Stuxnet INITIAL_ACCESS_VIA USB drive infection
The attackers attempted to overcome Natanz’s air gap by placing Stuxnet on USB sticks and getting them into the facility.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“the attackers came up with the idea of putting the virus on a USB stick”
Stuxnet USES USB drive infection
Stuxnet was distributed through infected USB sticks as a way to reach the air-gapped facility.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“USB sticks with the Stuxnet virus were spread”
Stuxnet USES worm propagation
A worm-based spreading mechanism was added so Stuxnet would infect Windows systems it encountered.
Explicit Confidence 99% · Kim Zetter EP 29 Details
“They used a worm and because of that, they would infect any Windows system that Stuxnet encountered.”
Stuxnet EXPLOITS unknown Windows bug
Stuxnet infected Windows machines by exploiting an unknown Windows bug.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“The malware would first have to infect a Windows machine to plant itself on it, which exploited an unknown Windows bug.”
Stuxnet AFFECTS Microsoft Windows
Stuxnet infected Microsoft Windows machines during its propagation.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“The malware would first have to infect a Windows machine to plant itself on it”
Stuxnet EXPLOITS SCADA software bug
After infecting a computer, Stuxnet altered SCADA software files by exploiting an unknown bug in that software.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“It would alter the files there, again exploiting an unknown bug in that SCATA software”
Stuxnet AFFECTS SCADA software
Stuxnet sought out and altered the SCADA software controlling the centrifuges.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“the virus can seek out the SCATA software that’s on that computer and this is the software that controls the centrifuges”
Stuxnet USES digital certificate
Stuxnet used an authentic digitally signed certificate to appear legitimate.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“the virus used an authentic digitally signed certificate to appear legitimate”
The operation had to account for Natanz computers being isolated from the internet by an air gap.
Explicit Confidence 98% · Jack Rhysider EP 29 Details
“the computers in Natanz were not reachable from the internet; they were air gapped”
Stuxnet ATTRIBUTED_TO United States
Kim Zetter directly attributes Stuxnet to the United States, although the episode also notes that the US never publicly confessed.
Explicit Confidence 92% · Kim Zetter EP 29 Details
“It was the US and Israel.”
Kim Zetter directly attributes Stuxnet to Israel, although the episode also notes that the operation was never publicly confessed.
Explicit Confidence 92% · Kim Zetter EP 29 Details
“It was the US and Israel.”
Stuxnet ASSOCIATED_WITH National Security Agency
The episode says the NSA probably crafted Stuxnet, but presents this as an uncertain assessment rather than a confirmed fact.
Uncertain Confidence 78% · Jack Rhysider EP 29 Details
“We think it was probably the NSA who crafted this virus”
Stuxnet ASSOCIATED_WITH Mossad
The episode says Israel’s Mossad likely attempted to place Stuxnet on computers used by Natanz personnel, but this is hedged.
Uncertain Confidence 72% · Jack Rhysider EP 29 Details
“the CSA or Israel’s Mossad likely tried to get it on the computers of the people working at the Natanz facility”
Stuxnet ASSOCIATED_WITH Central Intelligence Agency
The episode presents the CIA as possibly involved in earlier sabotage and intelligence collection connected to the Stuxnet operation.
Uncertain Confidence 78% · Jack Rhysider EP 29 Details
“The CIA were likely the ones introducing this faulty equipment into the facility”
Stuxnet ASSOCIATED_WITH Unit 8200
Unit 8200 was publicly suspected by news agencies, but Kim Zetter says the attribution is unclear and advises against pointing fingers at it.
Uncertain Confidence 90% · Kim Zetter EP 29 Details
“I wouldn’t point fingers at 8200.”
Stuxnet DISCOVERED_BY Symantec
Symantec researchers noticed, analyzed, and reported the Stuxnet malware after it spread beyond the intended target.
Explicit Confidence 99% · Jack Rhysider EP 29 Details
“security researchers from Symantec began noticing this virus and analyzing it and reporting about it”
Stuxnet INVOLVES International Atomic Energy Agency
IAEA inspectors visited Natanz and their reports provided evidence about centrifuge problems and the facility’s condition.
Explicit Confidence 98% · Kim Zetter EP 29 Details
“They started visiting Natanz a couple of times a month and they would write reports”
Stuxnet INVOLVES Oak Ridge National Laboratory
Oak Ridge National Laboratory was described as building centrifuge replicas and developing methods to damage them.
Explicit Confidence 96% · Jack Rhysider EP 29 Details
“out at Oakridge National Laboratory, they built a replica of the Natanz facility”
Stuxnet INVOLVES Idaho National Laboratory
Idaho National Laboratory was associated with the operation because of its industrial-control-system expertise, though the episode hedges that it may have assisted.
Uncertain Confidence 88% · Jack Rhysider EP 29 Details
“They may have received help from scientists at the Idaho Lab too”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:28:15.987596+00:00