Threat intelligence / Malware

Stuxnet

[Stuxnet](https://attack.mitre.org/software/S0603) was the first publicly reported malware to specifically target industrial control systems devices. [Stuxnet](https://attack.mitre.org/software/S0603) is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)(Citation: CISA ICS Advisory ICSA-10-272-01)(Citation: ESET Stuxnet Under the Microscope)(Citation: Langer Stuxnet) [Stuxnet](https://attack.mitre.org/software/S0603) was discovered in 2010, with some components being used as early as November 2008.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Stuxnet](https://attack.mitre.org/software/S0603) was the first publicly reported malware to specifically target industrial control systems devices. [Stuxnet](https://attack.mitre.org/software/S0603) is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)(Citation: CISA ICS Advisory ICSA-10-272-01)(Citation: ESET Stuxnet Under the Microscope)(Citation: Langer Stuxnet) [Stuxnet](https://attack.mitre.org/software/S0603) was discovered in 2010, with some components being used as early as November 2008.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)

Labels

malware

44 recorded

Relationships

uses

to Archive via Custom Method

Technique

uses

to Code Signing

Technique

uses

to Default Accounts

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploitation of Remote Services

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Indicator Removal

Technique

uses

to Internal Proxy

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Network Share Discovery

Technique

uses

to Peripheral Device Discovery

Technique

uses

to Query Registry

Technique

uses

to Remote Services

Technique

uses

to Replication Through Removable Media

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Shared Modules

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to SQL Stored Procedures

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Taint Shared Content

Technique

uses

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Web Protocols

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

6 external

References

mitre-attack

S0603

W32.Stuxnet

—

CISA ICS Advisory ICSA-10-272-01

https://us-cert.cisa.gov/ics/advisories/ICSA-10-272-01

ESET Stuxnet Under the Microscope

https://web-assets.esetstatic.com/wls/2012/11/Stuxnet_Under_the_Microscope.pdf

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en

Langer Stuxnet

https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf