# Cyberweapon Malicious software or code built and used by a state to cause physical destruction, disruption, or sabotage — software engineered to function as a weapon. The term implies more than ordinary malware: a cyberweapon typically targets specific systems for strategic effect, is developed with significant resources (usually by an intelligence or military agency), and is intended to produce damage in the physical or operational world rather than merely steal information. The category raises arms-control questions with no settled answers, because the "weapon" is information that can be copied, leaked, and reused. ## Stuxnet — the threshold case The concept's defining example is **Stuxnet**, the worm (widely attributed to a joint U.S.–Israeli operation, "Olympic Games") that around 2009–2010 sabotaged Iran's uranium-enrichment centrifuges at Natanz by subtly altering their controllers while feeding operators normal readings. Stuxnet is treated as the first true cyberweapon to cause real-world physical destruction, and the moment cyber operations crossed from espionage into kinetic effect. The vault's [[Stuxnet and Cyber Warfare Origins]] page covers the operation in depth; this page treats the broader *category* it inaugurated. ## The proliferation problem A cyberweapon differs from a conventional weapon in a way that makes it uniquely dangerous: **it is made of reusable information.** Three dynamics follow: - **Leakage and reuse.** Offensive tools escape their makers. The NSA's **EternalBlue** exploit was stolen and leaked by the Shadow Brokers in 2017, then weaponized within weeks into the **WannaCry** and **NotPetya** outbreaks — the latter the most destructive cyberattack in history (see [[Wiper Malware]]). The state that builds a cyberweapon cannot guarantee it stays in friendly hands. - **The vulnerability-stockpiling dilemma.** Cyberweapons run on undisclosed software flaws ("zero-days"). When a government discovers a flaw, it faces a choice: disclose it so it can be patched (defending everyone) or hoard it for offensive use (leaving everyone, including its own citizens, exposed). The U.S. formalized this trade-off as the **Vulnerabilities Equities Process**, and the NSA's "NOBUS" doctrine ("nobody but us" can exploit a given flaw) is the gamble that a hoarded vulnerability will stay exclusive — a gamble EternalBlue lost. - **Attribution and deniability.** Like other state cyber operations, cyberweapons can be laundered through proxies and obscured, complicating deterrence and response. ## Right-wing-KB relevance Cyberweapons sit at the center of contemporary national-security politics and several of this vault's threads. They link the offensive operations of [[Russian State Hacking Groups]] (Sandworm's grid attacks and NotPetya) and [[Chinese State Hacking Groups]] (infrastructure pre-positioning) to the deeper policy debate about whether democracies should be building, stockpiling, and risking the leak of digital arms at all. The EternalBlue story is a clean cautionary tale about state power turning against the public: a weapon built with taxpayer money, lost, and turned into a global wrecking ball. It also reframes the encryption-and-backdoor argument (see [[Crypto Wars and Encryption Policy]]) — the same "we can keep the keys safe" confidence that vulnerability-hoarding requires. ## Distinct from neighbors - **Malware (general)** — most malware steals or extorts; a cyberweapon is purpose-built for *strategic destruction/disruption* by a state. - **[[Wiper Malware]]** — a common *payload type* for cyberweapons aimed at destruction (NotPetya); not all cyberweapons are wipers (Stuxnet manipulated rather than wiped). - **Zero-day / exploit** — the *ammunition* (an unpatched flaw); the cyberweapon is the engineered tool that uses it. - **[[Supply-Chain Attack]]** — a *delivery method* a cyberweapon may ride in on. ## See Also - [[Stuxnet and Cyber Warfare Origins]] - [[Wiper Malware]] - [[Russian State Hacking Groups]] - [[Chinese State Hacking Groups]] - [[Crypto Wars and Encryption Policy]] - [[Cybersecurity Lexicon]] - [[Information Warfare Hub]]