Stuxnet Reconstruction Posted on GitHub, but Original Source Was Not Leaked

TechRadar reports that a GitHub account has published what it describes as a faithful reconstruction of Stuxnet, the worm associated with sabotage of Iranian uranium-enrichment centrifuges. Stuxnet is widely accepted as the first software to have caused physical destruction in the real world.

The repository appeared through a Show HN submission. Its README says the project was assembled from decompiled binaries, not leaked original source code. Those binaries have been publicly available since VirusBlokAda recovered samples from an Iranian customer's machines in June 2010.

Researchers and security companies later built analyses from those samples, including Symantec's W32.Stuxnet Dossier and Ralph Langner's To Kill a Centrifuge. Similar readable C-language projects have also appeared online. Amr Thabet published a decompilation of the MRxNet rootkit with a 2010 to 2011 copyright notice, while Christian Roggia published the open-myrtus dropper decompilation, copyrighted 2012 to 2014.

Developers discussing the new repository have expressed mixed views, with some calling it “AI slop” or a “fake.” The project says it was reproduced for educational purposes and is designed to work only on Windows XP and Windows 7. Commenters also noted that repeated references to “Stuxnet” could conflict with a faithful reconstruction, since Symantec adopted that name after using the identifier “W32.Temphid.”