Cybersecurity Case Studies: Stuxnet, WannaCry, and Pegasus

Explore how Stuxnet, a 500 kilobyte worm, used four zero-day vulnerabilities to target Iran's nuclear centrifuges through Siemens PLC, marking the first malware to affect physical infrastructure.

Stuxnet was a politically motivated cyber attack, likely from a U.S.–Israeli campaign (Operation Olympic Games) to derail Iran's uranium enrichment program and delay its nuclear weapons timeline.

Explore how centrifuges enrich uranium in nuclear plants and how PLCs, STL code, Windows field PGs, and Step 7 software control them, while noting the isolation of industrial networks.

Uncover how Stuxnet manipulated industrial control systems by altering PLC code and spreading via USB in air-gapped facilities. Explore zero-day exploits, a PLC rootkit, antivirus evasion, and the attack timeline.

Stuxnet entered via removable media from insiders, delivering a dropper that installs a dynamic link library, elevates privileges, injects into processes, and propagates through the Windows network.

Show how Stuxnet propagates to field PGs through four network techniques: print spooler zero-day, WinCC password abuse, network shares with WMI, and Windows Server Service RPC exploitation.

Stuxnet propagates via removable drives and USBs to field PGs, hides copies on infected media, and uses MRXNet.sys to intercept file operations and spread further.

Analyze how Stuxnet targets Windows systems running Step 7 to control PLC communication by replacing s7otbxdx.dll, infecting PLC blocks, and delivering a PLC rootkit that feeds false feedback.

Worm authors exploit plc devices by modifying code blocks to spy on industrial systems, causing centrifuges to spin too fast, send bogus data, and damage valves, derailing Iran's enrichment process.

Stuxnet contacts command and control servers over http on port 80 after infection, sending basic system details and enabling a back-door to upload and run code on the compromised machine.

Explore how Stuxnet uses a peer-to-peer rpc server and client to propagate updates across a network without outbound internet, enabling self-updating via version checks.

Stuxnet spread beyond its target, disabling hundreds of centrifuges, and was discovered later by Belarusian cyber security specialists, signaling a new era of infrastructure-focused malware.

Stuxnet spin offs reveal how the original malware inspired Duqu and Flame to spy and harvest data, while Havex, Industroyer, and Triton target energy, power, and safety systems.

Stuxnet marks a milestone in malicious code history. It exploits four zero-day flaws, compromises digital certificates, injects code into industrial control systems, and hides it from operators.

Explain how ransomware encrypts files or locks systems, demands ransom (often in Bitcoin) using fear tactics, and spreads via phishing emails and network exploits, including WannaCry as a case study.

Explore the evolving ransomware landscape from the AIDS Trojan to modern variants like WannaCry and CryptoWall, highlighting encryption, ransom payments, and high profile impacts on healthcare and critical infrastructure.

Understand modern ransomware life cycle from distribution to ransom demand, including infection, command and control, file encryption, and recovery, and learn offline backups and preventive measures to mitigate impact.

Explore the WannaCry ransomware outbreak of 2017, infecting 300,000 computers in 150 countries and disrupting healthcare and government sectors through a Windows vulnerability and Bitcoin payments.

Explains how WannaCry combines worm and ransomware components to spread and encrypt files. Demonstrates the EternalBlue SMB vulnerability enabling remote code execution and bitcoin ransom.

Explore how the WannaCry dropper tests connectivity to a gibberish URL, uses the result as a kill switch to prevent automated analysis, and how sinkholing the domain slowed the attack.

WannaCry drops PE32 binary, copies the extractor, and starts a Microsoft Security Center service. It renames the file, creates a registry entry, and uses VBScript to generate a decryption shortcut.

Analyze the WannaCry encryption component and its resources, including a password-protected ZIP with multilingual readmes, a tor-enabled configuration, s.wnry and t.wnry files, and the ransom note r.wnry, plus file-hiding behavior.

The video shows WannaCry checking for a running instance with a global mutex, decrypting the aes key with a hardcoded rsa key, loading the dll from T.wnry, and starting encryption.

Examine how Wanna Cry generates a unique RSA 2048 key pair, encrypts files with a 128-bit AES key, and stores keys in .eky and .dky for ransom.

WannaCry enumerates local, removable, and network drives and directories to locate a hardcoded list of target file extensions before encryption, avoiding .exe and .dll while encrypting documents, images, and videos.

Wanna Cry triggers post-encryption processes: taskdl.exe deletes remaining temp files, Wanna Decrypter shows a $300 Bitcoin ransom window, and taskse.exe periodically enumerates RDP sessions to launch the decrypter.

Wannacry enhances impact by deleting backups, preventing safe mode boot, and terminating services such as SQL and MS Exchange to prevent recovery and hinder data restoration.

Explain how WannaCry uses a Tor-based command and control to verify ransom payment and deliver the decryption key, loading onion addresses from c.wnry and reporting data over https.

Describe WannaCry ransom mechanics, including escalating payments up to $600 in bitcoins, the use of bitcoin addresses, and the $140,000 collected from 200k infections by August 2017.

Explore why data becomes unrecoverable in WannaCry’s cryptographic model, including a hard-coded key, per-file AES encryption, and an attacker private key that remains unknown until decryption for ransom.

Explore how WannaCry's worm component propagates rapidly by exploiting the EternalBlue vulnerability in SMB on Windows, scanning internal and external networks via ports 139 and 445.

Update Windows with the latest patch to stop WannaCry, as EternalBlue's SMB vulnerability was patched beforehand. Back up files and disable SMB v1 to strengthen defenses.

Highlight the enduring threat of Wanna Cry by showing how stolen government hacking tools and unpatched Windows systems enabled a historic ransomware outbreak, urging vigilance and proactive defense.

Explore spyware, a malicious software that secretly monitors devices, records keystrokes, captures data like credentials and banking info, and spreads through bundled software, malware sites, or phishing.

Explore how governments seek backdoor access and firms defend privacy with end-to-end encryption and bug bounty programs. See Pegasus by NSO Group surveilling iOS and Android devices via zero-click exploits.

Explore how Pegasus infects devices through phishing and zero-click attacks, using malicious links delivered by SMS or other channels, with exploit chains like Trident if the device is supported.

Explore how Trident iOS exploit chain uses a WebKit zero-day in Safari to gain code execution. It then leaks kernel memory and disables code signing to silently install surveillance software.

Learn how Pegasus, on jailbroken iOS devices, installs dynamic libraries through hooking into legitimate processes, establishes persistence via the JavaScript core binary, and uses self-destruct and surveillance to evade detection.

Pegasus spyware demonstrates comprehensive data gathering on mobile devices, including contacts, call logs, emails, texts, photos, passwords, and GPS. It enables real-time exfiltration and audio and camera capture.

Pegasus copies, compresses, and encrypts data with AES-128, then transmits it to a command and control server through an anonymizing network while buffering and securely deleting data after transmission.

Explore how the NSO Group's Pegasus spyware enabled government surveillance, raising legal and ethical questions about privacy, targeting journalists and human rights activists.

Pegasus uses a zero-day iPhone remote jailbreak called Trident to silently install spyware and surveil users; NSO Group markets such exploits, so keep devices up to date and vigilant.

Explore the stories of Stuxnet, WannaCry, and Pegasus and learn how cyber hygiene, timely software updates, and privacy ethics shape cybersecurity.