Stuxnet 2 Under Development By Spy Agencies?


It’s been a fair while since we’ve heard a mention of Stuxnet, so the potential for Stuxnet 2 is quite interesting. Of course at this point, it’s pretty much all just rumours – but still I’d be very surprised if such a thing wasn’t already in the works.

Apparently in this case, it’s the Saudi and Israeli governments working together so develop something more powerful than Stuxnet, for the same end – to disrupt Iran’s nuclear program and facilities.

Hold the front page: Saudi Arabian and Israeli spy agencies are developing a worm more powerful than Stuxnet to sabotage Iran’s nuclear program again, after meeting in Vienna last week.

Sound a little far-fetched? Well, stranger things have happened but this particular yarn comes from Iran’s FARS news agency, thought to have strong ties to the country’s Revolutionary Guard, so a healthy dose of scepticism is probably advised.

Citing “an informed source close to the Saudi secret service”, the agency claims that the November 24 meeting was held to “increase the two sides’ cooperation in intelligence and sabotage operations against Iran’s nuclear program”.

“One of the proposals raised in the meeting was the production of a malware worse than the Stuxnet to spy on and destroy the software structure of Iran’s nuclear program,” the source told FARS, adding that the $1m plan was welcomed by the Saudis.

It’ll be interesting to see in the coming months if anything actually turns up, and well even if it does – will Iran ever let us hear about it? For those not familiar with the original:

Stuxnet is a computer worm discovered in June 2010 that is believed to have been created by United States and Israel agencies to attack Iran’s nuclear facilities. Stuxnet initially spreads via Microsoft Windows, and targets Siemens industrial control systems. While it is not the first time that hackers have targeted industrial systems, it is the first discovered malware that spies on and subverts industrial systems, and the first to include a programmable logic controller (PLC) rootkit. – Wikipedia


The two sides had apparently set off on this hardline course after being frustrated by a warming of relations between the US and Iran and a deal struck between the Islamic Republic and the US, UK, Russia, China, France and Germany.

This November 24 deal, branded a “historic mistake” by Israel, will see Iran agree to halt some of its nuclear activities in return for around £4bn in sanctions relief.

The yarn certainly plays to the paranoia and FUD so often present in coverage of the Middle East, but it’s unlikely that Israel would want to anger its allies in Washington by jeopardising the recent rapprochement with Iran.

Unless, that is, the idea is to have the malware all ready to go in case there’s a sudden breakdown in talks.

A final thought: FARS lifted almost word-for-word an entire Onion story last year claiming most rural US voters would rather hang out with former Iranian president Mahmoud Ahmadinejad than Barack Obama.

The agency’s editorial judgement was called into question again this year after it posted a story claiming an Iranian boffin had invented a time machine.

If it follows a similar infection vector to the original Stuxnet tho, we probably would hear of it due to the massive Windows infections that precede the attacks on the industrial systems.

And well the original ‘source’ of this news is rather suspicious to say the least, with them publishing satire as real news last year.

Source: The Register

Posted in: Legal Issues, Malware, Privacy

, , , ,


Latest Posts:


HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.
OWASP APICheck - HTTP API DevSecOps Toolset OWASP APICheck – HTTP API DevSecOps Toolset
APICheck is an HTTP API DevSecOps toolset, it integrates existing tools, creates execution chains easily and is designed for integration with 3rd parties.
trident - Automated Password Spraying Tool trident – Automated Password Spraying Tool
The Trident project is an automated password spraying tool developed to be deployed on multiple cloud providers and provides advanced options around scheduling
tko-subs - Detect & Takeover Subdomains With Dead DNS Records tko-subs – Detect & Takeover Subdomains With Dead DNS Records
tko-subs is a tool that helps you to detect & takeover subdomains with dead DNS records, this could be dangling CNAMEs point to hosting services and more.


One Response to Stuxnet 2 Under Development By Spy Agencies?

  1. Michael December 4, 2013 at 3:51 pm #

    The Israelis & the Saudis working together?
    Did peace break out in the MidEast and nobody told me?
    This is the craziest thing I have read in a long time.

    Since this came from the Iranian news agency, which, as the article implies, has a reputation for making up fantastic conspiracy theories, then I guess we can just chuckle and move on.