Loading malware…
Stuxnet is a highly sophisticated Windows worm and industrial sabotage platform first publicly uncovered in 2010 and widely assessed as one of the earliest cyber weapons to cause deliberate physical effects in industrial environments. It was designed to propagate within Windows networks and via removable media, while ultimately targeting industrial control system environments associated with Iran’s nuclear program. Its operations are closely associated with sabotage of uranium-enrichment centrifuges, including manipulation of controller logic while presenting normal readings to operators and upstream monitoring systems.
Stuxnet combined multiple capabilities uncommon in earlier malware. It spread as a worm, including through USB media in air-gapped or semi-isolated environments, and used a malicious shortcut mechanism exploiting CVE-2010-2568 as part of its removable-media propagation chain. On infected Windows systems it performed discovery of security products, enumerated running processes related to defensive software, queried and modified the Windows Registry, enumerated removable drives for further infection, and established persistence through a driver registered as a boot-start service. It also used stealth techniques including rootkit-style file hiding and API hooking in user mode to conceal components during staging from removable media. Command-and-control communications over HTTP have also been documented.
A technically notable component is its USB loader, which loads additional stages from removable media into memory and uses import-table and native API hooking to hide malicious files before the main payload is fully installed. The loader employs anti-analysis and reliability measures such as obfuscated API resolution, PE validation, custom memory mapping, shellcode-based hook redirection, and repeated self-protective deletion attempts. These features reflect a mature, well-resourced development effort.
Stuxnet is historically linked to a broader cluster of state-linked malware and operations that includes Duqu and Flame through developmental and code relationships reported by multiple researchers. Public reporting has also associated its development with U.S. and allied offensive cyber capabilities, including NSA Tailored Access Operations, though some details of authorship and organizational roles remain sensitive or not fully public. Stuxnet remains a landmark case in cyber-physical operations because it demonstrated that malware could move beyond espionage and IT disruption to covertly manipulate industrial processes and damage physical equipment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The USB loader ~WTR4141.TMP runs automatically through triggering the file name “Copy of Shortcut to.lnk” in the USB device, which is exlointed by the LNK Vulnerability (CVE-2010-2568). | According to Wikipedia, Stuxnet is a malicious computer worm first uncovered on 17 June 2010... In this report I try to be focused on the small range on the USB loader ~WTR4141.TMP... Stuxnet ~WTR4141.TMP: USB Loader as a userland rootkit.
Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1) .LNK or (2) .PIF shortcut file, which is not properly handled during icon display in Windows Explorer, as demonstrated in the wild in July 2010, and originally reported for malware that leverages CVE-2010-2772 in Siemens WinCC SCADA systems.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Ultimately, it turned out that the fortuitous discoveries of Stuxnet, Duqu, and Flame were in fact related beyond superficial succession.
The tranquil days of reverse engineering banking trojans were pierced by Stuxnet, Duqu, Flame, Gauss, and MiniFlame.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
The USB loader ~WTR4141.TMP runs automatically through triggering the file name “Copy of Shortcut to.lnk” in the USB device... It loads itself from a removable drive to memory.
The ZwMapViewOfSection routine is the key to mapping a shared memory section into a process's address space. The loader uses two ZwMapViewOfSection routines for creating dual virtual address mappings for shared physical memory.
Fanny utilized two Stuxnet zero-days 1–2 years before Stuxnet entered the scene: the infamous LNK exploit (CVE-2010–2568)
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
you will find all technical details about the threat’s components and data structures, as well as high-level information, including: ... Injection techniques and anti-AV
Fanny utilized two Stuxnet zero-days 1–2 years before Stuxnet entered the scene: the infamous LNK exploit (CVE-2010–2568) and a privilege escalation embedded in the aforementioned Resource 207.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
In order to do anti-reverse engineering analysis, some key APIs are pre-obfuscated in ~WTR4141.TMP... deobfuscation via the XOR algorithm
you will find all technical details about the threat’s components and data structures, as well as high-level information, including: ... Injection techniques and anti-AV
In the case of Stuxnet, one of the former intelligence officials said that signatures were added by the Territorial Dispute team in 2010 after Stuxnet had begun to spread uncontrollably — spreading that led to its discovery and public exposure. “There were cleanup efforts,” the official said.
it destroys them with the design of a “robust delete” routine and tries 8 times to delete a file reliably, even if something blocks it and even if DeleteFile fails.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Drivers are often used to maintain access to an infected system and to hide suspicious activity from system administrators.
Hide the files via API chain hook both layers... kernel32.dll hook API as follows: FindFirstFileW FindNextFileW FindFirstFileExW ntdll.dll hook API as follows: NtQueryDirectoryFile ZwQueryDirectoryFile
Flame... was the first known attack to trick users in this way by hijacking the Microsoft Windows updating tool on machines to infect computers
It loads itself from a removable drive to memory and does the same way to the real payload ~WTR4132.TMP by reusable design. The loader avoids a direct LoadLibraryW call using a standard path; instead, it uses the specially crafted file name SHELL32.DLL.ASLR.[HEXADECIMAL]... mapped to a temporary region of memory
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
STUXSHOP: The Oldest Stuxnet Component Dials Up Stuxshop is ancient component folded into Stuxnet to manage it’s early command-and-control capabilities.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a notorious sabotage malware for comparison with Fast16.
Malware associated with cyber sabotage that affects machines, infrastructure, and national security rather than only stealing data.
A cyber weapon used to sabotage Iran’s nuclear program.
Referenced as a historical example of malware that crossed air gaps via USB drives rather than radio-based covert exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.