Stuxnet - Educational reconstruction of the infamous cyber-weapon
Show HN: Stuxnet – A reconstructed source code of the infamous cyber-weapon
This repository offers a strictly educational and research-oriented reconstruction of the Stuxnet worm, the first known cyber-weapon targeting industrial control systems. It provides a readable source code derived from decompiled binaries, preserving original logic and attack vectors. Ideal for malware analysis, defensive research, and academic study, it includes modules for privilege escalation, S7 hooking, rootkits, and the frequency-tampering payload. The code is structured for static analysis in controlled environments and is licensed under GPL v3.
This is an academic reconstruction. Use it to build stronger defenses, not to cause harm.
- kibitzor
Thanks for posting! ~15k lines of code, a lot to poke around in. I was working on a Siemens S7 PLC project with a WINCC HMI for a power plant (the same target of the cyber-weapon) as I listened to the audio book[2] based on this ~12 years ago, entirely changed how I viewed critical industrial infrastructure. One quote from the book that stuck with me was how you can only use a cyber weapon once at full potential, as it’ll either get patched and/or everyone can reverse engineer it to use.
For those not familiar with Stuxnet, it’s a discovered cyber-weapon from 2010 which “reportedly destroyed almost one-fifth of Iran's nuclear centrifuges. ” and “ neither the United States nor Israel has openly admitted responsibility” but likely were the developers [1]
[1-Wikipedia Entry](https://en.wikipedia.org/wiki/Stuxnet)
[2-“Countdown To Zero Day” book if you liked the Wikipedia entry](https://www.audible.com/pd/Countdown-to-Zero-Day-Audiobook/B...)
[3-“Zero Days” movie](https://www.imdb.com/title/tt5446858/)
- beavis000
I very much recommend reading "Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon". Fascinating stuff.
- mzs
I always wondered about how feasible the usb drive propagation bit always noted was. Was there ever any evidence that the hardware was already infected at a less scrupulous reseller? I’ve heard of another site in EU that had misbehaving s7. It could have been a reseller that played loose with licensing.
- outfitcolormatc
Thanks for posting that
- andai
g_dwCentrifugeDestroyed++;