Ten Years Later, EclecticIQ Examines Evolution of Stuxnet-like Attacks

6 min readNov 9, 2020

Stuxnet malware was reportedly a US-Israel joint enterprise against a critical infrastructure target. The main payload was allegedly introduced on a USB device by an insider threat working for the AVID, via supply-chain compromise. Stuxnet was an original malware tailored to cause ICS (Industrial Control System) connected systems to malfunction, contributing to physical destruction. The malware was code-signed and had worm capabilities. The current implications that similar threats have to public safety and geopolitics warrant further examination and review.

EclecticIQ analysts examined Stuxnet ten years after its discovery to address:

Similar threats to ICS demonstrated in attacks since Stuxnet.
Changes in threat actor capability and motivation.
Vulnerability assessment of ICS environments

ICS Attacks Are Still Resource Intensive to Develop and Are Likely to Remain Within the Realm of Nation-State Actors

EclecticIQ analysts conclude targeted destructive ICS attacks remain tailored, often requiring physical facility access, with low probability of widespread adoption by unsophisticated threat actors. At the same time, ICS attacks are of greater concern because of expanded adoption of ICS infrastructure globally and more nations demonstrating cyber-military capability.

Risk is highlighted by further attacks since Stuxnet, using similar malware deployments that include:

Flame (2012, 2014–2016)
GreyEnergy and BlackEnergy (2015, 2018)
Industroyer (2017)
Triton (2017)

In 2015 and 2020 there were separate attacks on water supply facilities in Israel that were not reported to be successful.

Each attack was highly specific and targeted, using custom malware to achieve its objective. Malware contained significant hardcoding of target-exclusive assets showing that the code was developed only after considerable reconnaissance of the target environment. Threat actors spend substantial time tailoring exploits, malware, and delivery vectors for each attack.