Chinese espionage group rootkit with systems software#
Chinese espionage group rootkit with systems windows#

Chinese espionage group rootkit with systems software#

The worm then propagates across the network, scanning for Siemens Step7 software on computers controlling a PLC. It is typically introduced to the target environment via an infected USB flash drive, thus crossing any air gap. Stuxnet has three modules: a worm that executes all routines related to the main payload of the attack a link file that automatically executes the propagated copies of the worm and a rootkit component responsible for hiding all malicious files and processes, to prevent detection of Stuxnet. Targeting industrial control systems, the worm infected over 200,000 computers and caused 1,000 machines to physically degrade. Stuxnet reportedly ruined almost one-fifth of Iran's nuclear centrifuges. Stuxnet's design and architecture are not domain-specific and it could be tailored as a platform for attacking modern SCADA and PLC systems (e.g., in factory assembly lines or power plants), most of which are in Europe, Japan, and the United States. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart.

Chinese espionage group rootkit with systems windows#

Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet specifically targets programmable logic controllers (PLCs), which allow the automation of electromechanical processes such as those used to control machinery and industrial processes including gas centrifuges for separating nuclear material. The program, started during the Bush administration, was rapidly expanded within the first months of Barack Obama's presidency. Although neither country has openly admitted responsibility, multiple independent news organizations recognize Stuxnet to be a cyberweapon built jointly by the United States and Israel in a collaborative effort known as Operation Olympic Games. Stuxnet targets supervisory control and data acquisition ( SCADA) systems and is believed to be responsible for causing substantial damage to the nuclear program of Iran.

Stuxnet is a malicious computer worm first uncovered in 2010 and thought to have been in development since at least 2005.