Sergey Ulasen

Background

Sergey Ulasen is a Belarusian computer security researcher who rose to international attention in 2010 for his role in uncovering the Stuxnet worm. He graduated in 2006 from the Belarusian State Technical University with a degree in software development and began his career at VirusBlokAda, a small antivirus vendor based in Minsk, Belarus. Starting as a programmer, Ulasen worked his way onto the team that engineered the company's antivirus scanning engine and became a team leader within that group by 2008, eventually helping manage a department of engineers focused on the company's AV kernel technology.

Discovery of Stuxnet

In June 2010, VirusBlokAda received a request for technical assistance from a customer whose computers in Iran were caught in an unexplained cycle of crashes and reboots. Ulasen, working with colleague Oleg Kupreev, examined the files involved and quickly suspected something more serious than a routine software conflict or false positive. Because the timing coincided with a weekend and Ulasen was attending a family event away from Minsk, part of the initial analysis was coordinated remotely with a contact in Iran; by the following Monday the team had confirmed the sample was unusually large compared to typical malware, used rootkit techniques to hide itself, and propagated in an atypical way.

Public Disclosure

On July 12, 2010, VirusBlokAda published a warning describing the malware as "very dangerous" and capable of uncontrolled spread, an announcement that is widely credited as the first public disclosure of what later became known as Stuxnet. Ulasen's team also identified that the malware installed kernel-mode drivers, later named mrxcls.sys and mrxnet.sys, which had been digitally signed using a certificate belonging to Realtek Semiconductor Corporation — a certificate that had evidently been stolen, since the signature otherwise passed as legitimate under Microsoft's code-signing checks. VirusBlokAda attempted to notify Microsoft and Realtek about the abused certificate before going public, but received little response, which factored into the decision to publish. A second stolen certificate, from JMicron Technology Corporation, was later found in use as well, and both certificates were subsequently revoked by VeriSign.

Significance of the Find

Subsequent analysis by researchers at Kaspersky Lab, Symantec, and other firms built on VirusBlokAda's initial report to reveal that the worm — which came to be called Stuxnet after strings found in its code — exploited multiple Windows zero-day vulnerabilities, including a previously unknown flaw in how Windows handled shortcut (.LNK) files, to spread via USB drives even across air-gapped networks. Deeper reverse engineering over the following months showed that Stuxnet's ultimate payload targeted Siemens programmable logic controllers used to run uranium-enrichment centrifuges, most notably at Iran's Natanz facility, marking it as the first malware widely understood to have been engineered to cause physical damage to industrial equipment. Ulasen's discovery is generally regarded as the trigger that set this chain of research in motion.

Later Career

Ulasen's prominence following the Stuxnet disclosure led to broader recognition within the security industry. In August 2011 he joined Kaspersky Lab, moving into a role within the company's threat research infrastructure, where he later directed a large team of engineers and analysts supporting Kaspersky's global malware research operations. He has since spoken publicly, including in an interview published on Kaspersky co-founder Eugene Kaspersky's official blog, about the circumstances of the Stuxnet find and its effect on his career.

Legacy

Ulasen is remembered primarily as the analyst whose routine technical-support investigation uncovered what is considered the first publicly confirmed cyberweapon designed to physically sabotage industrial control systems. The Stuxnet case reshaped how governments, vendors, and the security industry think about digital-certificate trust, zero-day vulnerability disclosure, and the potential for malware to be used as an instrument of state-directed sabotage.

Timeline

• 2006Ulasen graduates from Belarusian State Technical University with a degree in software development and begins working at VirusBlokAda.
• 2008Ulasen becomes team leader of VirusBlokAda's antivirus engine development group.
• 2010-06Ulasen and colleague Oleg Kupreev investigate reboot-loop reports from a VirusBlokAda customer in Iran and identify a sophisticated, previously unknown malware sample later named Stuxnet.
• 2010-07-12VirusBlokAda publishes a public warning describing the newly found malware as very dangerous, marking the first public disclosure of Stuxnet.
• 2010-07VirusBlokAda's findings that Stuxnet used drivers signed with a stolen Realtek Semiconductor certificate draw wide security-industry attention; a second stolen certificate from JMicron is later found.
• 2011-08Ulasen joins Kaspersky Lab's threat research infrastructure team.
• 2011-11Ulasen is profiled in an interview published on Eugene Kaspersky's official company blog, discussing the Stuxnet discovery.