How the mighty have fallen the notorious Stuxnet malware source code has
been replicated and posted on GitHub for all to see

Date:
Wed, 16 Sep 2026 23:05:00 +0000

Description:
Recreating a prolific malware using a mix of publicly available decompiled binaries and AI?

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter A pseudonymous GitHub account has published what it calls a reconstruction of Stuxnet malware that purportedly took out a fifth of Iran's centrifuges before being discovered
The original source has never surfaced, and the 'Stuxnet' moniker that the account uses comes from Symantec's coining of the name weeks after it was discovered The code remains unverified and untested, with some users indicating that it is likely an AI-generated replication of the original binaries' behavior, which has been widely documented A GitHub account has published what it describes as a faithful reconstruction of Stuxnet, the worm that sabotaged Iranian uranium-enrichment centrifuges.

It also became the first piece of software widely accepted as having caused physical destruction in the real world, highlighting how malicious software can often do much more harm to people and hardware than just stealing or manipulating data. The repository surfaced via a Show HN submission, which mainstream media outlets then picked up, highlighting the as-yet-unknown researcher's reverse-engineered code. Latest Videos From TechRadar Watch full video here: Not the first or last Stuxnet repository The original Stuxnet source, written by whoever built it, has never been leaked and did not leak last week. The repository's README explicitly states that it is a reconstruction assembled from decompiled binaries, and those binaries have been in public circulation since Belarusian firm VirusBlokAda pulled samples from an Iranian customer's machines in June 2010.

Everything that followed, including Symantec's W32.Stuxnet Dossier and Ralph Langner's To Kill a Centrifuge , was built on those samples and how they reacted in test environments. You may like Hundreds of GitHub repos found posing as real software to push malware Hackers are using evolved
capabilities in AI-generated malware to hit US critical infrastructure
Experts warn hackers are using AI chatbots to write malware using natural language

This is also not the first time readable C-language code aiming to replicate Stuxnet has been published online. Malware researcher Amr Thabet published a decompilation of the MRxNet rootkit carrying a 2010 to 2011 copyright notice. Christian Roggia followed with a dropper decompilation called open-myrtus, copyrighted 2012 to 2014, which has since been forked into a long chain of repositories.

The irony is that if such code were a faithful replication of the infamous malware, it would not have mentioned "Stuxnet" in multiple places, including registry keys. This is because the moniker is not one the developers likely used, but one Symantec switched to from its original 'W32.Temphid'
identifier. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over.

The thread where it was first brought to attention by a user called Sadpainy also has mixed views from developers, many of whom have branded it 'AI slop' or a 'fake' that relies on a mixture of already existing repositories, even
as the about page on its GitHub repo states that it was reproduced by the researcher for educational purposes and is designed to only work on Windows
XP and Windows 7.

For those looking to test it, a virtual machine might be their best bet, especially given Stuxnet's ability to physically damage hardware, but it is also a stark reminder of what a rogue AI agent could do if left unchecked without specific instructions or safeguards. Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/how-the-mighty-have-fallen-the-notoriou s-stuxnet-malware-source-code-has-been-replicated-and-posted-on-github-for-all -to-see


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)