ALT-35 · Analysis · 23 Oct 2026
Stuxnet: code that broke machines
The first widely documented cyber weapon built to cause physical damage: a worm that reprogrammed industrial controllers at Iran's Natanz enrichment plant while showing operators normal readings.
- ~2007–2009Earlier versions are active, according to later analyses.
- Jun 2010VirusBlokAda reports the worm; it is named Stuxnet.
- Sep 2010 – Feb 2011Symantec and Langner publish detailed analyses of its target and payload.
What it did
The payload only activated on a precise configuration of controllers and frequency converters. It changed motor speeds in ways designed to stress the centrifuges over time, while the operators' screens showed recorded, normal values.
Why it mattered
Stuxnet proved that code could destroy equipment, that air gaps can be crossed, and that industrial systems trust their own sensors completely. It also escaped its target and was studied by everyone — including potential adversaries.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Air gaps reduce exposure; they do not remove it. Removable media and engineers' laptops cross them.
- Industrial safety depends on telemetry you can trust independently of the control system.
- Cyber weapons leak, and once studied they are reused.
What to do
- Control removable media and maintenance laptops in industrial networks.
- Keep independent, physical safety instrumentation that the control network cannot override.
- Monitor changes to controller logic, not just network traffic.
Sources
- Symantec — W32.Stuxnet Dossier (Falliere, Murchu, Chien, 2011)
- Ralph Langner — To Kill a Centrifuge (2013)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-35 — Stuxnet: code that broke machines. 23 Oct 2026. altumptic.com/research/stuxnet-2010