- A pseudonymous GitHub account has published what it calls a reconstruction of Stuxnet malware that purportedly took out a fifth of Iran’s centrifuges before being discovered
- The original source has never surfaced, and the ‘Stuxnet’ moniker that the account uses comes from Symantec’s coining of the name weeks after it was discovered
- The code remains unverified and untested, with some users indicating that it is likely an AI-generated replication of the original binaries’ behavior, which has been widely documented
A GitHub account has published what it describes as a faithful reconstruction of Stuxnet, the worm that sabotaged Iranian uranium-enrichment centrifuges.
It also became the first piece of software widely accepted as having caused physical destruction in the real world, highlighting how malicious software can often do much more harm to people and hardware than just stealing or manipulating data.
The repository surfacedcked up, highlighting the as-yet-unknown researcher’s reverse-engineered code
Not the first or last Stuxnet repository
The original Stuxnet not leak last week. The repository’s README explicitly states that it is a reconstruction assembled from decompiled binaries, and those binaries have been in public circulation since Belarusian firm VirusBlokAda pulled samples from an Iranian customer’s machines in June 2010
Everything that followed, including Symantec’s W32.Stuxnet Dossier and Ralph Langner’s To Kill a Centrifuge, was built on those samples and how they reacted in test environments.
This is also not the first time readable C-language code aiming to replicate Stuxnet has been published online. Malware researcher Amr Thabet published a decompilation of the MRxNet rootkit carrying a 2010 to 2011 copyright notice. Christian Roggia followed with a dropper decompilation called open-myrtus, copyrighted 2012 to 2014, which has since been forked into a long chain of repositories.
The irony is that if such code were a faithful replication of the infamous malware, it would not have mentioned “Stuxnet” in multiple places, including registry keys. This is because the moniker is not one the developers likely used, but one Symantec switched to from its original ‘W32.Temphid’ identifier.
The thread where it was first brought to attention by a user called Sadpainy also has mixed views from developers, many of whom have branded it ‘AI slop’ or a ‘fake’ that relies on a mixture of already existing repositories, even as the about page on its GitHub repo states that it was reproduced by the researcher for educational purposes and is designed to only work on Windows XP and Windows 7.
For those looking to test it, a virtual machine might be their best bet, especially given Stuxnet’s ability to physically damage hardware, but it is also a stark reminder of what a rogue AI agent could do if left unchecked without specific instructions or safeguards.
