07/22/2025 | Press release | Distributed by Public on 07/22/2025 10:50
WASHINGTON, D.C. - Today, House Committee on Homeland Security Chairman Andrew Garbarino (R-NY) delivered the following opening statement in a Subcommittee on Cybersecurity and Infrastructure Protection hearing to examine the evolution of threats to critical infrastructure following the discovery of Stuxnet 15 years ago.
As prepared for delivery:
Fifteen years ago, the world learned of Stuxnet - a computer worm that forever altered the cyber threat landscape. Regarded as "the world's first digital weapon," Stuxnet was designed to target industrial control systems. It was used against Iran's nuclear program, reportedly destroying 1,000 centrifuges at the Natanz enrichment plant.
Malware, or malicious software, has existed since at least the 1970s. However, Stuxnet was different from its predecessors. The discovery of Stuxnet demonstrated both the physical impact of malware and raised important questions about cybersecurity defense and offense. These are issues we continue to face today.
Stuxnet revealed the significant impact that offensive cyber tools can have on critical infrastructure. Stuxnet also demonstrated the importance of securing operational technology (OT). By exploiting key vulnerabilities in industrial control systems, Stuxnet proved that cybersecurity is not only an IT issue. Cybersecurity threats can affect critical infrastructure we depend on daily, from water treatment to energy facilities. The cybersecurity threat landscape continues to expand, and we need to make sure our cyber professionals are prepared to defend both IT and OT. Doing so will strengthen the public and private sectors' ability to rapidly respond to threats.
Since discovering Stuxnet 15 years ago, cybersecurity threats to critical infrastructure have drastically evolved and spread beyond just malware. We now see various cyber capabilities being used to hack critical infrastructure, including phishing, social engineering, denial-of-service attacks, and more. While cyberattack vectors have grown and matured, malware is still of great concern. Malware comes in many forms, such as keyloggers, spyware, viruses, and ransomware, with ransomware comprising one-third of all cyberattacks in 2024.
The interconnected nature of our networks, devices, and infrastructure means that critical infrastructure owners and operators now experience far more attacks than when Stuxnet was unleashed. And zero day vulnerabilities are far from being eliminated.
Strengthening domestic cybersecurity resilience remains a key priority for this Committee. Considering the sophisticated cybersecurity threats we now face, we are once again reminded of the importance of reauthorizing two key authorities ahead of their expiration this year: the Cybersecurity Information Sharing Act (CISA 2015) and the State and Local Cybersecurity Grant Program.
Reauthorizing CISA 2015 will ensure we keep encouraging rapid and trusted information sharing among public and private sector entities; and Extending the State and Local Cybersecurity Grant Program will make sure that states and localities have reliable funding to strengthen their cybersecurity posture.
It is also worth examining the state of the Iranian cyber threat and the potential impact Stuxnet had on Iran's cybersecurity posture. According to Nozomi Networks Labs, cyberattacks from Iranian threat actors surged by 133% in May and June 2025. An active Department of Homeland Security National Terrorism Advisory System notice also emphasizes the need to remain on high alert to Iranian cybersecurity threats to U.S. critical infrastructure.
Iran has embraced the targeting of critical infrastructure. Islamic Revolutionary Guard Corps-affiliated actors have recently targeted OT, such as U.S. industrial control systems, in key sectors such as water and healthcare.
I look forward to examining the current threats facing U.S. critical infrastructure and the enduring significance of Stuxnet with our panel of expert witnesses. Today's witnesses represent a range of perspectives, and I thank you all for contributing to our discussion about this pivotal moment in the history of cybersecurity. I am confident that your testimony will help us form a better understanding of today's "digital weapons" and the state of U.S. critical infrastructure resilience.
###