The Stuxnet worm is a "groundbreaking" piece of
malware so devious in its use of unpatched vulnerabilities, so sophisticated in its multipronged approach, that the security researchers who tore it apart believe it may be the work of state-backed professionals.
"It's amazing, really, the resources that went into this worm," said Liam O Murchu, manager of operations with Symantec's security response team.
"I'd call it groundbreaking," said Roel Schouwenberg, a senior antivirus researcher at Kaspersky Lab. By comparison, other notable attacks, like the one dubbed "Aurora" that hacked Google's network, and those of dozens of other major companies, was child's play.
O Murchu and Schouwenberg should know: They work for the two security companies that discovered Stuxnet exploited not just one zero-day Windows bug, but four, an unprecedented number for a single piece of malware.
Stuxnet, which was first reported in mid-June by VirusBlokAda, a little-known security firm based in Belarus, gained notoriety a month later when Microsoft confirmed that the worm was actively targeting Windows PCs that
managed large-scale industrial-control systems in manufacturing and utility firms.
Those control systems are often dubbed SCADA, for "supervisory control and data acquisition," and run everything from power plants and factory machinery to oil pipelines and military installations.
At the time, researchers believed Stuxnet -- whose roots were later traced as far back as June 2009 -- exploited a single unpatched, or "zero-day" vulnerability in Windows and spread through infected USB flash drives.
Iran was hardest hit by Stuxnet, according to Symantec researchers, who said in July that nearly 60 percent of all infected PCs were located in that country.
