The Most Dangerous Computer Viruses in History

A worm that halted every train on an Eastern US railway. An ATM that spat cash at a stranger’s command. A virus that made Iranian centrifuges tear themselves apart while the scientists in the control room watched green lights.

The Paint Explainer walks through ten of the most dangerous computer viruses ever released — what each one targeted, how it got inside, and what it took to clean up afterward. The pattern is the disturbing part: almost none of them needed to be clever. A USB stick on the ground, a default password, one unpatched update — that was the whole door.

1. Triton

In the summer of 2017, workers at a massive petrochemical plant in Saudi Arabia noticed something strange when their entire facility suddenly shut down. Everyone assumed a mechanical glitch — until cybersecurity experts found a new type of virus called Triton. This was not a program trying to steal credit card numbers or spam inboxes. Triton would have caused an actual attack that cost lives.

  • The target: large factories run on safety instrumented systems — think of them as the automatic emergency brakes for the plant. If a pipe gets too hot or pressure builds to a dangerous level, the system instantly shuts everything down to prevent an explosion.
  • The plan: the attackers spent months secretly exploring the factory network until they understood exactly how those emergency brakes worked, then built a custom virus to silently take them over and turn them off — so a dangerous situation would escalate instead of triggering a shutdown.
  • The mistake: a tiny flaw in their code. While reprogramming the safety system, they accidentally triggered it instead. The safety computers did exactly what they were built to do and safely shut down the plant, ruining the silent plan and alerting managers that something was wrong.
  • The result: a huge explosion was avoided and lives were saved — by the very system the hackers had tried to disable.

2. Incontroller

In the spring of 2022, security experts discovered a massive digital weapon before the hackers had the chance to pull the trigger. Had it been used, it could have become one of the worst cyber attacks in history.

  • What it targeted: PLCs — special tiny computers built directly into machinery that control how fast a robotic arm moves, how much pressure sits in a gas pipe, or when a water valve opens.
  • What it was: a highly advanced, customizable toolkit built specifically to hack PLCs, giving attackers complete control of the machinery from thousands of miles away.
  • The worst cases: at a liquid natural gas facility, pressure driven far past safe limits with the safety alarms switched off, so workers would know nothing until pipes exploded. At a power plant, switches flipped to plunge cities or hospitals into darkness for days. At a water treatment plant, valves forced wide open to flood neighborhoods with untreated sewage — or the clean supply cut off. Inside heavy robots, motors driven until the machines tore themselves apart with workers standing nearby.
  • Why it stood out: older industrial viruses were built for one target and could not be reused. Incontroller was designed to be easily changed and reused at different types of facilities anywhere in the world.

3. Agent.btz

Sometime in 2008, in the Middle East, a man left USB flash drives in locations where American military personnel were guaranteed to find them. Eventually a soldier picked one up, plugged it into a laptop — and that laptop was connected directly to the highly guarded network of the United States Central Command. The man who left the drives was likely a foreign agent, probably connected to the Russians.

  • The worm: the moment the drive was connected, agent.btz silently woke up — a completely invisible digital spy with one mission: steal military secrets. It spread through both classified and unclassified systems, opening backdoors for attackers to reach in from far away.
  • How it kept moving: the worm constantly watched for new USB drives. When one appeared, it copied itself and hid a folder for the stolen information. Plug that drive into a clean computer and the cycle started all over again.
  • The clean-up: the Pentagon launched Operation Buckshot Yankee, a 14-month effort to scrub the worm from its networks, and the Defense Department took the extreme step of banning every USB drive across the entire military.
  • The legacy: the United States eventually created an entirely new military division to deal with the threat — Cyber Command.

4. Stuxnet

Around 2010, a new virus called Stuxnet was discovered, and it had a very different goal from other viruses: a top-secret nuclear facility in Iran called Natanz. Because the site was so important, its network was completely disconnected from the internet — so the attackers likely relied on a spy or worker plugging in an infected USB drive inside the building.

  • The hunt: once inside, Stuxnet searched the network for one thing only — the tiny industrial computers controlling the facility’s centrifuges, the giant metal tubes that spin incredibly fast to purify nuclear material.
  • The attack: it reprogrammed the machinery to spin far faster than designed, then suddenly slow down. That intense stress caused the delicate machines to literally tear themselves apart from the inside.
  • The cover: just like robbers looping a bank’s security footage, Stuxnet recorded what the normal safety gauges looked like and played the fake data back to the scientists’ screens — green lights and normal numbers while the machines in the next room destroyed themselves.
  • The damage: by the time workers realized it, Stuxnet had ruined nearly a thousand centrifuges, setting the Iranian nuclear program back by months or even years. Experts who took the code apart were shocked by how massive, advanced and expensive it was.

5. NotPetya

In June 2017, businesses all across Ukraine downloaded a routine update for a popular piece of accounting software. That update carried a hidden weapon that would become one of the most destructive cyber attacks in history.

  • The disguise: it acted like ransomware, restarting infected computers with a demand for $300. But the payment email address was already shut down, and the code could not unlock the files at all. It was never a tool for making money — it was built solely to destroy data permanently.
  • The spread: no click required. NotPetya used a highly classified digital lock pick stolen from the United States government, letting it jump automatically from computer to computer across entire networks in seconds.
  • Who and why: the attackers were widely believed to be Russian military hackers aiming to paralyze Ukraine — then they completely lost control of their creation. Within hours it was destroying businesses around the globe.
  • The wreckage: shipping giant Maersk had cargo ships sitting motionless in ports because nobody knew what was inside the containers; international delivery services and medicine manufacturing were disrupted; companies bought tens of thousands of new computers and rebuilt from scratch.
  • The bill: more than $10 billion in total global damage.

6. Sobig.F

In the late summer of 2003, a worm called Sobig.F was detected, and it could have caused the loss of many lives. It arrived in inboxes looking completely normal, using spoofing to fake the sender address so the message seemed to come from a trusted friend or a legitimate company.

  • The spread: millions clicked the attachment without a second thought. The worm then hunted the infected computer for more email addresses and used the victim’s own connection to blast out thousands of copies.
  • The scale: at the peak of the outbreak, experts estimated one out of every 17 emails sent anywhere in the world was a copy of this exact worm — clogging global networks.
  • The near-miss: the flood overwhelmed the networks of railway giant CSX Corporation in the Eastern United States. Vital electronic signaling and dispatching systems failed, forcing the company to halt every train where it stood. Without that stop, hundreds or even thousands of people might have died in collisions.
  • The end: billions of dollars in global damage — then, built into the code, an expiration date. On September 10th, 2003, Sobig.F simply deactivated itself. Its creators have never been identified.

7. Conficker

By late 2008, most people believed the internet was safer than in its earlier days — antivirus software kept improving. Then, in November, a new threat appeared: the Conficker worm, exploiting a hidden flaw in Microsoft Windows. Microsoft had released a fix a month earlier, but millions of people and organizations had not installed it.

  • Its tradecraft: once inside, Conficker acted like a trained spy — switching off automatic backups and security tools, blocking the machine from visiting antivirus websites, and copying itself onto USB sticks to infect the next computer.
  • The botnet: it linked infected machines into a giant network — a remote-controlled robot army. To stay untraceable, it generated tens of thousands of random web addresses every day, only needing to reach one to receive new orders. Global experts raced to guess and block them, but the virus was too fast.
  • The waiting game: it became the largest botnet ever created, and the world waited in fear for the attack that never came. Its creators used it for a few small spam campaigns, then seemed to abandon it.
  • The cost: hospitals in the UK delayed medical scans, the French military grounded airplanes, and at its peak Conficker infected up to 15 million computers. Nobody knows who built it or what it was really for.

8. Carbanak

Around 2014, security experts discovered a completely new type of virus that shocked the world. Built by highly skilled hackers, Carbanak did not target ordinary bank customers — it went directly after the banks themselves.

  • The entry: a simple email to a bank worker, looking exactly like a normal business document, secretly carrying the virus. Once opened, it installed itself silently.
  • The patience: no money was stolen right away. The hackers recorded the computer screens of bank staff for months, watching exactly how employees transferred money, managed accounts and controlled cash machines.
  • The takeover: they set up fake accounts and moved millions to themselves, pressing the exact same buttons the real employees used so it looked like routine bank business.
  • The ATM trick: the virus could send a remote command telling a street cash machine to spit out money at a very specific time. A person working for the hackers simply stood in front of the machine, caught the cash as it flew out, and walked away without ever inserting a card.
  • The total: an estimated $1 billion stolen from more than 100 banks across 30 countries — and the banks had no idea until the vaults came up short.

9. Mirai

By 2016, smart devices were everywhere in people’s homes — and they shipped from the factory with extremely simple default passwords like admin or 12345 that owners almost never changed. A group of young computer gamers realized they could use that laziness, and created Mirai — Japanese for “future.”

  • How it hunted: Mirai roamed the internet for vulnerable cameras and routers, simply trying that short list of factory passwords. Since millions of devices were unprotected, it slipped inside easily.
  • The zombie: the infected device kept working normally, so the owner noticed nothing — while deep in its memory it was secretly taking orders from the hackers.
  • The army: hundreds of thousands of household gadgets linked into one botnet. Its creators first used it against rival servers in the video game Minecraft.
  • The main event: in October 2016 they aimed the whole army at Dyn, a company that acted like the internet’s directory. The junk-data flood overwhelmed Dyn and crashed it, knocking Netflix, Twitter and Reddit offline for hours across North America and Europe.

10. Anna Kournikova

In February 2001, a 20-year-old student from the Netherlands named Jan de Wit used a simple free program he found online to build a virus in just a few minutes — he didn’t even know how to write complex code. He named it after Anna Kournikova, then one of the most famous tennis players in the world.

  • The trick: victims received an email with a subject line making it look like a message from a friend, containing an attached file that appeared to be a photo of the tennis star. The file was actually a hidden script.
  • The cycle: once opened, the virus searched the email software for contacts and secretly sent a copy to everyone on the list. Those friends clicked the fake picture, and the cycle repeated.
  • The damage: unlike other viruses, it did not destroy files or steal passwords. The problem was the wave of traffic — corporate email servers worldwide choked on millions of junk messages and crashed, forcing large businesses and government offices to shut down their email systems entirely to clean up.
  • The confession: the situation grew so huge and caused so much panic that the young creator became scared of what he had unleashed. A few days after releasing it, he walked into a local police station and confessed.
Virus Year What happened
Triton 2017 Safety-system attack stopped by its own bug
Incontroller 2022 Found before it could be used
Agent.btz 2008 14 months to clean the Pentagon
Stuxnet 2010 Nearly a thousand centrifuges destroyed
NotPetya 2017 Over $10 billion in global damage
Sobig.F 2003 1 in every 17 emails worldwide
Conficker 2008 Up to 15 million machines infected
Carbanak 2014 $1 billion stolen from 100+ banks
Mirai 2016 Netflix, Twitter and Reddit knocked offline
Anna Kournikova 2001 Email servers crashed worldwide

What Comes Next?

Read down the list and watch the targets move out of the inbox. Sobig.F and Anna Kournikova clogged email. Conficker and Mirai assembled robot armies. Carbanak walked into the vaults. Stuxnet, Triton and Incontroller went after the machinery itself — the valves, the brakes, the centrifuges — where a successful attack is measured in pressure readings and casualties rather than in files.

The other pattern is how often the door was already open. Microsoft had patched the Conficker flaw a month early. The safety system at the Saudi plant worked perfectly and shut the virus down. Devices shipped with passwords nobody changed. In nearly every case here, the defense existed before the attack did — and the difference between a footnote and a disaster was whether anyone had bothered to use it.

Image Credits

Views: 7

Leave a Reply

Your email address will not be published. Required fields are marked *

Trending now

Every Major Gap in History We Still Don’t Understand
The Most Guarded Places on Earth You Can Visit (Pt. 3)
The Nine Levels of Hell, Explained (Dante’s Inferno)
Every Political Ideology Explained