Stuxnet网络武器重构源代码在GitHub发布

GitHub上发布了一个项目，其中包含了对Stuxnet蠕虫的重构源代码1。这款恶意软件在2010年被发现，是已知的第一个旨在对工业控制系统造成物理破坏的网络武器1。该重构工作基于全球安全研究社区多年的逆向工程成果1，项目采用GNU通用公共许可证v3.0许可证1。

Stuxnet的攻击目标是西门子工业控制系统，包括SIMATIC WinCC、Step 7和S7-300/400 PLC1。该恶意软件通过USB驱动器、网络共享和P2P等多种方式传播1。其核心攻击机制是修改可编程逻辑控制器（PLC）的块逻辑，改变马达频率导致离心机转子损坏1。为了规避检测，Stuxnet采用了高级Rootkit功能用于隐藏文件、进程和注册表1。

项目发布方声明，该代码仅供学术研究、恶意软件分析培训和防御研究使用，不能用于任何恶意目的1。

A GitHub repository has published reconstructed source code for Stuxnet, the notorious cyber-weapon first discovered in 2010.1 The project draws on years of reverse-engineering work by the global security research community and is intended for academic study, malware analysis training, and defensive research purposes.1

Stuxnet holds the distinction of being the first known cyber-weapon designed to cause physical damage to industrial control systems.1 The malware specifically targeted Siemens SIMATIC WinCC, Step 7, and S7-300/400 programmable logic controllers.1 It propagated through multiple vectors, including USB drives exploiting the LNK vulnerability, network shares via print spooler vulnerabilities, and peer-to-peer mechanisms.1 Once deployed, the attack payload modified PLC logic blocks to alter motor frequencies, resulting in damage to centrifuge rotors.1

The reconstructed code reveals sophisticated concealment techniques, employing advanced rootkit functionality through MRxCls.sys and MRxNet.sys drivers to hide files, processes, and registry entries.1 The project is distributed under the GNU General Public License v3.0 and includes an explicit disclaimer stating the code is solely for academic research, malware analysis training, and defensive research, with prohibition against any malicious use.1