2009–2015: Stuxnet, Sony & the Age of Cyber Weapons

← Back to the full list · Previous: Part 2 — The 2000s

The World in 2009

By 2009, three shifts were colliding. The cloud and smartphone era began, putting personal and corporate data into giant central platforms. State hackers professionalized, graduating from the smash-and-grab of Titan Rain into quiet, multi-year intrusions aimed at Silicon Valley itself. And the Stuxnet decade opened: governments discovered that code could do what cruise missiles used to — cross borders, enter fortified facilities, and destroy physical machinery — without a shot being fired.

The seven attacks in this part take us from Google’s servers to Iranian centrifuge halls, from the web’s certificate trust system to a Hollywood studio extorted over a comedy film, and finally to the US government’s deepest personnel vaults.

8. Operation Aurora (2009) — The Attack That Made Google Leave China

How the attack unfolded

In mid-2009, employees at some of the world’s most sophisticated technology companies began receiving emails that were — for once — genuinely well-made: references that made sense, context that fit, links or attachments worth clicking. At Google and elsewhere, someone clicked. The payload exploited a previously unknown flaw in Internet Explorer 6, giving the attackers a foothold on internal workstations. From there they moved deliberately through internal networks, hunting for two things: source code and, at Google specifically, the Gmail accounts of Chinese human-rights activists — two targets that told everyone exactly what kind of attacker this was.

The intruders reached Google’s single-sign-on password system, then called Gaia (the ancestor of today’s Google account authentication), and copied its source code. Similar intrusions ran in parallel at dozens of other companies — McAfee’s Dmitri Alperovitch would later count over two dozen significant victims, spanning tech, defense, chemicals, and finance. Researchers at McAfee found a meaningful clue in the malware itself — a directory path containing the word “Aurora” — and the campaign got its name.

Then came the extraordinary part: on January 12, 2010, Google went public. In a blog post titled “A new approach to China,” the company disclosed the intrusion, said it had evidence pointing at China, tied the attacks to the Gmail accounts of activists, and announced it would stop censoring google.cn — adding it was prepared to withdraw from China entirely. Companies simply did not do this; victims of state espionage stayed quiet, and nobody picked a public fight with Beijing over hacking. The post landed like a bomb in both the tech industry and US-China relations.

The damage

The direct technical damage — stolen source, compromised accounts — was contained (Google said no accounts were actually breached, and it reset relevant credentials). The strategic damage was enormous. Aurora converted “APT” from intelligence-community jargon into a boardroom word overnight: suddenly every Fortune 500 CISO was being asked by directors whether “the Google thing” could happen to them. China denied involvement and called Google’s behavior “irresponsible,” but the commercial relationship never recovered.

Aftermath & lessons

• In March 2010, Google redirected google.cn to the uncensored google.com.hk — functionally ending its mainland Chinese search presence, forgoing one of the world’s largest internet markets.
• Google accelerated the rollout of two-step verification and defaulted-HTTPS across its services — consumer security features that reached hundreds of millions of people partly because of this attack — and pushed hard on browser sandboxing (Chrome’s architecture as a response to the IE 6 era).
• Aurora fixed the template for public attribution debates: strong private confidence, cautious public wording, and diplomatic fallout rather than legal consequences.

The core lesson: intellectual property and human rights converged as targeting criteria — an espionage actor will pursue both your crown-jewel source code and individual dissidents’ mailboxes in the same campaign. And sometimes a victim with market power will fight back in public.

9. Stuxnet (2010) — The First Cyber Weapon

How the attack unfolded

Stuxnet is the most consequential piece of malware ever written, and the story of its discovery is a legend of the industry. In June 2010, engineers at a small Belarusian antivirus firm, VirusBlokAda, investigated why machines in Iran kept crashing mysteriously. The culprit looked impossible: a worm spreading through Windows networks and USB sticks, armed with four different zero-day exploits at once (including the LNK vulnerability that executed code the moment a USB icon was rendered), signed with stolen digital certificates from respected hardware firms, and carrying a payload aimed not at Windows at all — but at Siemens programmable logic controllers, the industrial computers that run factories, pipelines, and power plants.

As researchers at Symantec and Kaspersky decompiled it over the following months, the true targeting emerged. Stuxnet wasn’t after any factory. It hunted for one specific configuration: Siemens S7-315 and S7-417 controllers attached to frequency-converter drives spinning at very specific speeds — the profile of the IR-1 gas centrifuges in Iran’s uranium enrichment plant at Natanz. Infection statistics told the same story: Iran accounted for the majority of detected infections worldwide, with Indonesia and India trailing.

What the payload did was physically elegant. Centrifuges enriching uranium spin at extreme speeds on delicate rotors; Stuxnet took control of the drives and violently manipulated rotor speeds — pushing them far above and below their safe operating ranges — while recording 21 seconds of perfectly normal sensor data and replaying that loop to the plant’s monitoring screens. For months, Iranian engineers watched gauges that insisted everything was fine while centrifuges destroyed themselves in slow motion. Iran ended up losing on the order of 1,000 centrifuges — replaced, secretly, while officials blamed mechanical failures and vendor quality.

The program behind it — codenamed Olympic Games — was revealed by New York Times reporter David Sanger in 2012: begun under President George W. Bush and accelerated under President Obama, jointly built with Israel (which had reportedly tested the payload on real centrifuges at its Dimona nuclear research center). Edward Snowden’s 2013 leaks corroborated the NSA–Israeli unit collaboration. Then, as Sanger’s reporting tells it, an engineering error in a later version caused Stuxnet to escape Natanz’s air-gapped network and spread across the world — where it could not run its payload, but could be found.

The damage

Physically: roughly a fifth of Natanz’s operating centrifuges, and by most expert estimates a 1–2 year delay in Iran’s enrichment program (analysts still debate the exact strategic effect; Iran’s stockpile trajectory continued). Historically: Stuxnet crossed every line at once. It was a nation-state attack that crossed a border into fortified infrastructure and destroyed physical equipment — sabotage in the classic sense, delivered by software. The International Telecommunication Union called it a “game changer”; security researchers called it the first weapon built entirely from code.

Aftermath & lessons

• The demonstration effect cuts both ways. Stuxnet proved industrial destruction was possible — to Iran’s Revolutionary Guard as much as to anyone. Iran’s subsequent wiper attacks on Gulf energy companies (Shamoon, below) are widely interpreted as part reply.
• The zero-day economy went mainstream. Four zero-days in one package showed the scale of state arsenals; a decade later, leaked NSA exploits would fuel global ransomware disasters (WannaCry, NotPetya — Part 4).
• Air gaps don’t save you. Stuxnet crossed a physically isolated network via USB sticks — human carriage — establishing that “we’re not connected to the internet” is a comfort, not a defense.
• The ICS security industry (industrial control system defense) effectively began its modern era here, as did the diplomatic conversation on norms for attacking critical infrastructure.

The core lesson: code is now a strategic weapon. Stuxnet’s lasting significance isn’t the 1,000 centrifuges — it’s that every military planner on Earth watched it work.

10. The RSA SecurID Breach (2011) — Stealing the Keys to Corporate Two-Factor Auth

How the attack unfolded

The breach of RSA in March 2011 became a parable told at every security conference for a decade — because of how precisely it combined the mundane and the catastrophic.

The attackers emailed two small groups of RSA employees with a subject line reading “2011 Recruitment Plan.” Attached was an Excel spreadsheet. One recipient thought it might be real and pulled it out of their junk mail folder to open it. The spreadsheet contained a crafted Flash (SWF) object exploiting a zero-day vulnerability (CVE-2011-0609); exploitation installed a variant of the Poison Ivy remote-access trojan, which beaconed home through a secured, encoded channel — camouflaged to look like innocuous network traffic. From there the intruders moved to the machine they wanted and took what they came for: information related to the SecurID two-factor authentication system — the hardware tokens used, among other clients, by banks, governments, and the largest US defense contractors.

RSA’s public disclosure, on March 17, 2011, was maddeningly vague about what exactly “related information” meant — a vagueness that fed months of speculation. The answer arrived in May: intruders attempted to break into Lockheed Martin by combining cloned SecurID token codes with stolen or guessed passwords — using, essentially, a copy of the seed values that generate each token’s ever-changing numbers. Lockheed said its defenses detected and blocked the attack (other contractors, including Northrop Grumman and L-3, were reportedly probed as well).

The damage

The direct financial toll — RSA replacing tens of millions of tokens and spending an estimated $66 million on remediation — understates the strategic damage. Two-factor authentication was the foundation of trust for countless sensitive networks, and the message was now that the foundation’s own keys had been lifted. RSA faced fierce criticism for the opacity of its disclosure; customers spent the better part of a year reassessing what “two-factor” really guaranteed.

Aftermath & lessons

• The breach supercharged the move toward stronger second factors — and helped set the stage for the FIDO Alliance and phishing-resistant authentication, because the industry confronted a hard truth: a shared-seed token system is only as safe as the vendor’s own network.
• It canonized several awareness-training tropes: the junk-folder rescue (attackers know you’ll rescue plausible mail), the single workstation that matters, and the reality that security companies are premier targets precisely because breaching them scales to all their customers.
• The “APT playbook” — targeted phish, zero-day, RAT, quiet lateral movement — became fully public through RSA’s unusually detailed post-incident writeups.

The core lesson: trust is transitive, and attackers buy it wholesale: breach the vendor, inherit the customers.

11. The DigiNotar Collapse (2011) — When the Web’s Trust System Broke

How the attack unfolded

The padlock in your browser means nothing by itself. It means something because a trusted Certificate Authority (CA) has cryptographically vouched that google.com really is Google. In 2011, a single hacker demonstrated what happens when one of those gatekeepers falls.

His online handle was Comodohacker, and DigiNotar wasn’t even his first: in March 2011 he had breached registration authorities affiliated with the CA Comodo (through compromised reseller accounts in Italy and the US) and minted nine rogue certificates — for mail.google.com, login.live.com, login.yahoo.com, addons.mozilla.org, Skype, and more. He signed them for his own name, taunting the industry with proof he could impersonate the world’s biggest services. The browsers revoked those certificates quickly; the industry treated it as a reseller hygiene problem. It wasn’t.

In July 2011, he breached DigiNotar, a Dutch CA in the small town of Zoetermeer — and this time generated over 500 fraudulent certificates, including a wildcard for *.google.com. What happened next turned a hack into a human-rights incident: during August 2011, interception infrastructure in Iran — most plausibly at ISP level, under state direction — used the forged Google certificate to mount a man-in-the-middle attack against Gmail users in Iran. Roughly 300,000 connections, overwhelmingly Iranians accessing Gmail, were intercepted; login credentials were harvested from people for whom private email can be a matter of prison and worse. The hacker, who claimed pro-government Iranian motives and boasted of acting alone at 21 years old, later said his goal was exactly this — to hand the Iranian state the keys to its citizens’ communications.

The house of cards collapsed fast. Google’s Chrome detected the fraud (thanks to certificate pinning — hard-coding expectations for Google’s own certificates), and Google publicly warned Iranian users in late August. Investigation found DigiNotar had been catastrophically negligent: the intrusion went back to early July, audit logs had been manipulated, and — uniquely damning — DigiNotar had months earlier detected rogue-certificate generation on its network and failed to report it properly. Because DigiNotar also issued the certificates behind the Dutch government’s DigiD online identity system, the state took operational control of the company within days. Browser vendors revoked trust in every DigiNotar certificate at once. In September 2011, DigiNotar was bankrupt — a CA destroyed from existence, something no regulator could have ordered.

The damage

Beyond the intercepted communications, the deeper injury was systemic: the web’s trust architecture — hundreds of CAs, any one of which can vouch for any domain on Earth — was shown to be only as strong as its weakest, sleepiest member. A regional Dutch firm’s lapse had jeopardized the mailboxes of dissidents 5,000 kilometers away.

Aftermath & lessons

• The industry response reshaped the CA ecosystem: mandatory audits tightened, multi-perspective issuance validation (checking certificate requests from multiple vantage points to detect fraud) became standard, and the movement toward Certificate Transparency — Google’s public, cryptographically verifiable log of all issued certificates, so rogue certs can be detected automatically — gained the urgency that carried it into every major browser.
• Certificate pinning spread; browsers hardened their root programs and began distrusting or delisting CAs for far smaller sins.
• The case remains the definitive proof that in a system of delegated trust, everyone is critical infrastructure.

The core lesson: SSL’s security model had a hidden assumption — that all certificate authorities are equally well-run. One bored hacker in 2011 disproved it, and the web’s trust system had to be rebuilt with transparency and verification.

12. Shamoon / Saudi Aramco (2012) — 30,000 Computers Wiped in Hours

How the attack unfolded

On August 15, 2012 — deliberately timed in the middle of Ramadan, when offices ran skeleton crews — malware began tearing through Saudi Aramco’s corporate network. Called Shamoon (from a path string in its code), it worked like a digital shredder: it systematically overwrote files with garbage data, then destroyed the master boot record of every machine it touched — the code that lets a computer start at all — replacing it with an image of a burning American flag. Thirty thousand PCs and servers, three-quarters of Aramco’s corporate computing estate, were reduced to bricks in a matter of hours.

A previously unknown group calling itself “Cutting Sword of Justice” claimed the attack, framing it as retaliation against the Saudi state (Aramco’s owner) — but the code’s sophistication, targeting, and timing pointed elsewhere. Within weeks, US officials were attributing it to Iran, and the accepted interpretation became the one that still holds: Shamoon was Iran’s answer to Stuxnet — proof, delivered to the world’s oil market, that if Iran’s infrastructure could be sabotaged by code, so could the Gulf’s. Days later, a similar strike hit Qatar’s RasGas, knocking out its corporate web and email (though not its liquefied-natural-gas production).

Aramco’s response became its own case study. The company severed itself from the internet almost entirely, buying time by unplugging; it shut down internal connectivity to protect untouched segments, then began the surreal logistics of recovery — reportedly buying up vast quantities of hard drives from global suppliers (spot prices reportedly twitched) and rebuilding tens of thousands of machines from bare metal over roughly two weeks. Critically, oil production never stopped: the operational technology that actually pumps, measures, and ships oil sat on isolated networks. Shamoon destroyed the office world, not the oil.

The damage

Measured purely in dollars, Aramco never published a full figure; measured in market signal, the attack told every state with a grudge that a few million dollars of malware could stagger the world’s largest oil exporter. It also inaugurated the modern “wiper” era: attacks whose goal is not theft or ransom but pure destruction — a category that would later include NotPetya, the most destructive attack of all time (Part 4).

Aftermath & lessons

• Aramco invested heavily and became a world leader in industrial cybersecurity — building one of the region’s most advanced security operations centers. Gulf national oil companies collectively hardened their OT segmentation.
• Shamoon returned in 2016–2017 (“Shamoon 2”) against Saudi government and private-sector targets, now paired with a second wiper and Telegram-based command-and-control, proving the capability was a program, not an incident.
• The attack fixed the IT/OT lesson in industry practice: production survived because it was segregated from office networks. Every industrial-security standard written since restates this in some form.

The core lesson: destructive cyberattacks are now an instrument of state coercion, and they aim at economies, not just militaries. The defense that worked at Aramco was unglamorous and decades old: segmentation.

13. The Sony Pictures Hack (2014) — A Movie Premiere Held Hostage by a Nation-State

How the attack unfolded

On November 24, 2014, the Monday before Thanksgiving, Sony Pictures employees found a creepy red skeleton glaring from their screens. The machines were dying: a wiper (later named Destover, with hard-coded Sony network paths betraying deep insider familiarity) was destroying data while the intruders — calling themselves the Guardians of Peace (GOP) — began uploading the largest trove of corporate secrets ever taken from a Hollywood studio: at least tens of terabytes, by some estimates ~100 TB.

Over the following weeks the leaks came in stages, each engineered for maximum humiliation: unreleased films (Fury, Annie, Still Alice and others) dumped on piracy networks; executive emails by the hundreds of thousands — including a racist joke about President Obama between co-chair Amy Pascal and producer Scott Rudin that ended careers and relationships; salary data exposing pay gaps; and the Social Security numbers and medical records of ordinary employees, who would spend years in identity-theft limbo.

Then the motive surfaced. Sony was about to release The Interview, a comedy in which Seth Rogen and James Franco are recruited to assassinate Kim Jong-un. North Korea had been demanding the film’s destruction for months — a “wanton act of terror,” an “act of war.” In early December, the GOP escalated to language no studio had ever faced: invoking 9/11, it threatened violence against movie theaters showing the film. On December 16, the major US theater chains, one after another, declined to screen it; the next day Sony canceled the wide release entirely — a capitulation that drew a remarkable public rebuke from President Obama himself, who said the studio had “made a mistake” letting a regime censor an American film by intimidation.

On December 19, 2014, the FBI formally and publicly attributed the hack to North Korea — citing technical overlaps with previous North Korean malware and infrastructure evidence. It was the first time the US government had publicly blamed a nation-state for attacking a private company. Pyongyang denied everything while suggesting the victorious “Guardians of Peace” might have been sympathizers anywhere in the world — a wink it has repeated in later attacks. Sony eventually released the film through independent theaters and streaming platforms on Christmas Day, and in January 2015 the US imposed its first-ever sanctions for a cyberattack on a corporation, blacklisting North Korean agencies and individuals.

The damage

Sony reported roughly $35 million in direct costs (IT rebuild, the lost theatrical window, legal exposure), with total impact widely estimated toward $100 million once lawsuits, insurance battles, and remediation settled in. Amy Pascal exited the co-chairmanship. Employees sued; insurers fought Sony over whether a nation-state attack counted as “war.” The strategic damage was larger than Sony: every authoritarian regime learned that a cyber campaign could threaten free expression globally, and every studio learned that its email server is a bomb strapped to its reputation.

Aftermath & lessons

• The hack invented the “leak-everything” extortion model — doxxing as leverage — which ransomware crews industrialized by 2019 (steal-then-leak double extortion).
• It previewed the attribution-and-sanctions playbook now standard for US responses to state attacks on companies.
• It exposed the catastrophic blast radius of retained email — a decade of informal, honest, embarrassing internal writing, all exfiltrated in one campaign. Post-Sony, companies started asking why old email is kept at all.

The core lesson: when attackers steal everything, the most expensive data isn’t financial — it’s human: opinions, jokes, health records, politics. And a state will attack a company over speech.

14. The OPM Breach (2015) — China Steals America’s Security-Clearance Crown Jewels

How the attack unfolded

The US Office of Personnel Management is the government’s personnel department — and, as the operator of background investigations, the custodian of the SF-86: the 127-page form every applicant for a security clearance completes, listing foreign contacts, relatives, past addresses, finances, drug use, medical and mental-health treatment, and every vulnerability that might make someone susceptible to blackmail. Aggregate the SF-86s of the entire national-security apparatus and you hold a counterintelligence encyclopedia — who knows what, who owes whom, who is lying to their spouse.

Chinese-linked hackers had been inside OPM’s environment in waves since roughly 2013, entering partly through compromised contractors (including KeyPoint Government Solutions, a cleared-investigation firm that itself reported a breach in 2014). In April 2015, in one of the great ironic moments in security history, OPM discovered the intrusion during a product demonstration: a new endpoint-security tool being piloted (at the recommendation of the Justice Department after earlier intrusions) flagged active attackers on the network — intruders who had been quietly exfiltrating data for months.

The disclosure, in June 2015, unfolded in painful stages: first 4 million personnel files, then the background-investigation universe — 21.5 million applicants plus family members, finally totaling about 22.7 million people, along with 5.6 million fingerprints. Current and former White House staff, CIA officers, military intelligence, contractors, and their families. Officials past and present described it as among the most damaging counterintelligence losses in US history: with a database cross-reference, an adversary could identify patterns of association — including, in the worst analyses, hints of covert identities — and target individuals by their weaknesses.

The damage

Director Katherine Archuleta resigned in July 2015 under withering criticism. The Government Accountability Office and Congress documented the underlying rot: legacy systems without encryption or multifactor authentication, weak contractor oversight, audit gaps — the breach was judged preventable by basic hygiene. Remediation included years of credit and identity monitoring for millions of victims (contracts north of $130 million), and in 2023 a federal judge approved a $63 million settlement for the class. The counterintelligence cost is unknowable: China never faced charges, and the data never comes back — SF-86s are valid for life.

Aftermath & lessons

• The breach triggered a federal security modernization push: multifactor authentication mandates, accelerated “Einstein” network sensing, the creation of the US Digital Service, and aggressive consolidation of background-investigation functions into a new dedicated agency (NBIB, then DCSA).
• It fixed the insight that the most sensitive data often sits at the most boring agency — an HR department, not a weapons lab — and that contractors are the perimeter: intruders entered through cleared firms whose own networks were softer.
• OPM also joined Stuxnet-era lore as the moment the US government internalized that a patient state adversary will simply wait inside networks for years, and detection — not prevention — determines what it costs you.

The core lesson: aggregated personal data is strategic data. OPM’s 22.7 million files did more for the adversary than any single stolen weapon could — because trust, once mapped, can be exploited forever.

Next in the series: Part 4 — 2016–2019: WannaCry, NotPetya, Mirai and the wildest years in internet history →