☰Series Navigation (13 parts)
There’s an old rule about weapons that every military eventually learns the hard way. Once you use a new one, you’ve shown everyone else how it’s done, and you no longer have it to yourself. The catapult, the machine gun, the atomic bomb, each one changed the world the day it was used, and everyone who saw what it could do copied it.
Stuxnet was that kind of weapon, and the people who built it should have known the rule. They built the first piece of software proven to destroy physical machines, they used it, and it got loose. After that, the idea was free. Any government with the money and the will could see that it worked, take the concept apart, and build its own. What they built fills the rest of these pages.
I don’t admire Stuxnet, and I get uneasy when people tell its story like a heist movie. Somebody decided to use a weapon that couldn’t be recalled, and everyone who runs a plant, a pipeline, or a utility network has been living with that decision ever since. The engineers who keep those systems running never got a vote, and they’re the ones paying for it.
What happened to Iran after Stuxnet?
Start with the target, because the results there are more modest than the legend.
Stuxnet destroyed roughly a thousand centrifuges and cost Iran time, by most estimates somewhere between a few months and two years of delay. It did that without an airstrike and without giving Iran a clear enemy to blame in the early going. As a piece of sabotage, it did real work.
But it didn’t stop the program. Iran replaced the broken centrifuges, kept enriching, and came out of the episode with something it hadn’t had before: a reason and a template to build its own offensive cyber force.
I can’t understand how anyone planning Stuxnet thought a proud country would take that hit and sit still. Iran studied what happened and answered, and within a few years it had cyber capabilities of its own and was using them.
Watch: STUXNET: The World's First Digital Weapon, Disrupt
Shamoon: the answer that wiped 30,000 machines
In 2012, a piece of malware called Shamoon hit Saudi Aramco, the Saudi national oil company and among the most valuable companies on earth. It didn’t spy and it didn’t steal. It wiped, erasing the data on some 30,000 computers and replacing it with a burning image, then doing the same at a second energy company.
Shamoon is widely attributed to Iran, and the timing tells the story. A few years after Stuxnet taught Iran that infrastructure could be attacked through code, Iran was reportedly running that lesson against the oil industry of a regional rival. This is the pattern that repeats through the whole aftermath: the weapon doesn’t stay with its inventor, and the first people to copy it are often the people it was first used against.
Think about the people who absorbed that blow. They worked in an oil company’s IT department, and they came in to find some 30,000 machines wiped and a business waiting on them to bring it back. Nobody asked them whether they wanted to stand on the front line of a conflict between governments. That’s the worst of this whole chain of events: the bill keeps landing on operations staff who never signed up for a war.
Duqu and Flame: the family that came with it
Even before the copies came from other countries, Stuxnet turned out not to be alone. Researchers taking it apart found close relatives that appeared to share its origins.
Duqu, found in 2011, was built for intelligence gathering. It logged keystrokes and gathered system information, the kind of reconnaissance you run before an attack, and its code shared enough with Stuxnet that analysts concluded the two came from the same workshop.
Flame, uncovered in 2012, was a sprawling spying tool that could record conversations, capture screenshots, log keystrokes, and pull data off machines, aimed mostly at targets in Iran and the wider Middle East. Together they showed that Stuxnet was only the visible piece of a larger, sustained program of the same kind, most of it built to watch instead of break. I think the public conversation did everyone a disservice by fixating on the one weapon that made headlines.
I find this the unsettling part. The centrifuge attack got the headlines because it broke something, but the reconnaissance tools running alongside it are the ones built to sit inside a system for months, saying nothing, learning everything. In my operations years, the intrusion that scared me was always the one that had been there a long time before anybody noticed, because that one had already learned where everything was.
The Ukraine grid: turning off the lights
Then the pattern moved from data to the physical world. Stuxnet’s real inheritance shows there.
In December 2015, attackers took down part of Ukraine’s power grid, cutting electricity to hundreds of thousands of people.
Operators watched their own controls move on the screen, worked by hands that weren’t theirs, opening the breakers that carried the power. Human attackers were at the keyboard in real time, reaching into a physical system and switching it off. It was widely attributed to a Russian group.
Picture that control room. The operators watched a cursor move across their own screens and open breakers they were responsible for, and they couldn’t stop it. Hundreds of thousands of people lost power in a Ukrainian December. Anyone who has run operations knows what it is to watch your own system turn against you, and I doubt the people who build these tools give that a moment’s thought.
A year later, in December 2016, they did it again to part of Kyiv, and this time the tool was different in a way that matters. The 2015 attack needed people at the keyboard issuing each command. The 2016 attack used a malware structure, later called Industroyer or Crash Override, that could act on its own. It understood the protocols that grid equipment speaks, and it could throw the switches automatically once it was set loose. The human moved up and out of the loop, and the code ran the attack.
That shift is the direct line from Stuxnet. Stuxnet carried its own instructions for wrecking centrifuges once it found them, needing no operator at the moment of damage. Industroyer carried its own instructions for opening breakers. The weapon that runs by itself once delivered is the model, and it’s the same model that makes the AI agent attacks I’ve written about so dangerous: a machine doing the harm at machine speed, with the person no longer required.
Triton: aiming at the last line of defense
The most frightening of Stuxnet’s descendants came in 2017, and it went after the one system nobody is supposed to touch.
A petrochemical plant in Saudi Arabia was hit by malware later called Triton.
Its target was the safety instrumented system, the controllers whose entire job is to shut a process down before it reaches an explosion or a release of poison gas. Those systems are the last line of defense in a plant that handles dangerous materials. They exist so that when everything else fails, something still stops a disaster that could kill the people working there.
Triton was built to disable that. Reach the safety system, switch off its protection, and you’ve removed the thing standing between an industrial accident and a catastrophe. The attack was caught before it caused the worst, reportedly because it accidentally tripped a shutdown and drew attention, but the intent was plain. Someone had built a weapon aimed at the safeguards that keep human beings alive.
Stuxnet broke machines. Triton was built to take away the protections that keep machines from killing the people standing next to them, and that one makes me angry in a way the others don’t. Whoever wrote it decided that the workers on shift at that plant were an acceptable price for whatever message they meant to send. The field traveled that distance in seven years, and it got there because Stuxnet showed the first step was possible.
What is Stuxnet’s real legacy?
It normalized the idea that a nation can reach through a computer and break another nation’s physical world, and it proved a wall couldn’t stop that.
Before Stuxnet, attacking infrastructure meant bombs and soldiers, things a country could see coming and answer in kind, under rules built up over centuries.
Stuxnet opened a way to do that damage with code: covertly, deniably, and from anywhere, against targets that thought their isolation protected them.
The nuclear powers noticed. Governments that had never spent much on cyber weapons started spending, hard, because a tool had just been shown that could reach the places their tanks and planes could not. The arms race it started is still running, and there are no treaties governing it the way there are for the older weapons.
There’s no treaty because the countries that would have to sign one are the same countries building the weapons, and I don’t expect that to change until something breaks badly enough to embarrass all of them at once. The people on shift when it happens won’t be the ones who made the decisions.
One point keeps landing on me across this whole series: none of the descendants needed a new idea.
They needed the first proof that the idea worked. Stuxnet was that proof. Every attack in this series after it, and every AI incident I’ve covered since, is a variation on the thing Stuxnet established: that the barrier you trust (an air gap, a supplier, the isolation of a test environment) is only a barrier until someone shows it can be crossed. Once crossed, it’s a map.
What angers me is how little the defensive side has been given since. The attackers got their proof of concept and spent the years since building on it, while too many operators of plants and utilities are still asked to defend them on budgets that treat security as optional. The governments that opened this door owe the people running those plants far more help than they’ve handed them.
The next articles leave the world of state cyberweapons for a different kind of trust betrayed: a militant group whose low-tech devices were turned into weapons, and the supply chains that let it happen. For the wider view of security and the people who need to understand it, the cybersecurity hub collects the rest of my work.
