Speaker A
I love you. Back in 2000, this virus showed the whole world how dangerous a single email could be. And it started with a broke college student who just wanted free internet.
A look at famous computer viruses, from the 2000 'I Love You' email worm to Agent.BTZ, Stuxnet, WannaCry, and a Saudi plant attack, and how they spread.
Key Takeaways
- Malware has evolved from simple nuisance and data destruction to financial theft, physical sabotage, and threats to human safety.
- Social engineering and human behavior, such as opening attachments or plugging in unknown USB drives, are often the entry point.
- Weak laws and gaps in regulation can let malware authors escape consequences.
- Air-gapped systems are not immune, as Stuxnet and the USB-based spread of Agent.BTZ demonstrate.
What the video covers
- The 'I Love You' virus (2000), written by Onel de Guzman, spread via email attachments and overwrote files, causing around $10 billion in damage.
- De Guzman was traced quickly but faced no charges because the Philippines had no anti-malware laws in 2000.
- Agent.BTZ (2008) spread through infected USB drives and infiltrated the US military's CENTCOM network, prompting a 14-month cleanup and a military-wide USB ban.
- Stuxnet (discovered around 2010) was a physical-sabotage worm that targeted Iran's Natanz centrifuges, spinning them past safe limits while showing normal readings to operators.
- A banking heist malware kept hackers watching employees' screens for months before stealing money in a way that looked like normal activity.
- WannaCry (2017) was a ransomware attack built on a leaked NSA exploit that hit over 200,000 computers in 150 countries.
- Botnets turn infected computers into 'zombies' controlled remotely, and the video describes an army of hundreds of thousands of such machines.
- The video covers a malware that disrupted DNS, which translates website names into IP addresses.
- A 2017 attack on a Saudi petrochemical plant showed malware could threaten physical safety, risking toxic releases, fires, and explosions.
- Overall, the video frames these cases as a progression from annoyance to data theft to physical destruction and endangerment.
Chapters
- 00:00The 'I Love You' Virus and Its Origins
- 00:56How the Email Worm Spread and Its Damage
- 02:08The Philippines Loophole and Agent.BTZ Introduction
- 03:16USB Spread and the Military Infiltration
- 04:31Stuxnet and Physical Sabotage of Iran's Centrifuges
- 06:00Banking Heist Malware and Months of Surveillance
- 07:48WannaCry Ransomware and the Leaked NSA Exploit
- 10:06Botnets, Zombie Computers, and DNS Attacks
- 13:00The Saudi Petrochemical Plant Attack and Closing Thoughts
Full Transcript — Download SRT & Markdown
Speaker A
student in Manila in the Philippines. Back then, internet wasn't a flat monthly bill. You paid by the minute.
Speaker A
His name was Onel de Guzman, a computer science student in Manila, in the Philippines. Back then, internet wasn't a flat monthly bill. You paid by the minute. And de Guzman couldn't afford it. So he had an idea for his college thesis, a program that could quietly steal people's internet passwords so someone like him could use the internet without paying. His professors rejected it. One of them literally wrote, "This is illegal," in the margins. De Guzman decided to drop out, turned his idea into a virus, and let it loose.
Speaker A
illegal." In the margins, Guzman decided to drop out and turned his idea into a virus and [music] let it loose. People got an email with a subject line that just said, "I love you." Inside was an attachment that looked like a simple
Speaker A
People got an email with a subject line that just said, "I love you." Inside was an attachment that looked like a simple text file, a love letter. Now, think about that for a second. If you got an email from someone you know saying, "I love you," you're clicking it. Curiosity, ego, whatever it is, you're opening that. And the moment you did, the virus was in.
Speaker A
Curiosity, ego, whatever it is, you're opening that. And the moment you did, the virus was in. Once it was on your computer, the virus did two things. It started wrecking your files, overwriting your photos and documents. And then it
Speaker A
Once it was on your computer, the virus did two things. It started wrecking your files, overwriting your photos and documents. And then it quietly opened your email contacts list and sent the exact same love letter to every single person on your list. So now the virus is arriving in your friends' inboxes from you, someone they trust, so they click it, too. And it just exploded outward like that.
Speaker A
outward like that. And when I say exploded, I mean it. Within 24 hours, it had hit around 45 million computers. It took down email systems at the Pentagon, the CIA, and the British Parliament.
Speaker A
And when I say exploded, I mean it. Within 24 hours, it had hit around 45 million computers. It took down email systems at the Pentagon, the CIA, and the British Parliament. Companies like Ford had to shut their email off completely just to stop it. In total, it caused something like $10 billion in damage.
Speaker A
They caught him. They traced the whole thing back to Duzman pretty quickly. But nothing happened. In 2000, the Philippines had no laws against malware, so every charge was dropped and he walked away completely free. Agent.BTZ.
Speaker A
Now, here's the part that's almost funnier than the virus. They caught him. They traced the whole thing back to de Guzman pretty quickly. But nothing happened. In 2000, the Philippines had no laws against malware, so every charge was dropped and he walked away completely free.
Speaker A
happened. Someone picked one up, walked it inside, and plugged it into a laptop just to see what was on it. That laptop was connected to US Central Command, the network running the actual wars in Iraq and Afghanistan. And the moment that
Speaker A
Agent.BTZ. Back in 2008, somebody scattered a few infected USB flash drives around a US military base in the Middle East. A parking lot, a kiosk, wherever a soldier might find one. And eventually, exactly what they were counting on happened. Someone picked one up, walked it inside, and plugged it into a laptop just to see what was on it.
Speaker A
here's the clever, genuinely creepy part. How it spread. Agent.btz was built to travel by USB, and it did it in a loop. Step one, it infects the computer.
Speaker A
That laptop was connected to US Central Command, the network running the actual wars in Iraq and Afghanistan. And the moment that drive went in, a malware called Agent.BTZ woke up and slipped into the network. It was digging through folders for secret documents and opening back doors so foreign attackers could reach in from the outside and pull data out.
Speaker A
totally different computer, a clean one, and plugs the same drive in. And boom, [music] that computer's infected now, too. And the loop starts over. No internet needed, no download. It just quietly rode from machine to machine on the backs of the people using them. So,
Speaker A
Now, here's the clever, genuinely creepy part: how it spread. Agent.BTZ was built to travel by USB, and it did it in a loop. Step one, it infects the computer. Step two, it sits there and waits. And the moment anyone plugs a new USB drive into that infected machine, it silently copies itself onto that new drive. Step three, that person, having no idea, walks over to a totally different computer, a clean one, and plugs the same drive in. And boom, that computer's infected now, too. And the loop starts over. No internet needed, no download. It just quietly rode from machine to machine on the backs of the people using them.
Speaker A
military on Earth got infiltrated and couldn't say for sure who did it, and cleaning it up became a nightmare. The Pentagon launched a 14-month operation just to scrub this [music] thing out of their systems. Their emergency fix in
Speaker A
So, who was behind it? The best guess is Russian intelligence, though it was never fully proven. And some people at the Pentagon doubted it was even a deliberate attack, which is its own kind of scary. The most powerful military on Earth got infiltrated and couldn't say for sure who did it, and cleaning it up became a nightmare. The Pentagon launched a 14-month operation just to scrub this thing out of their systems. Their emergency fix in the meantime was almost funny. They banned USB drives across the whole military. And on a lot of computers, they literally sealed the ports shut with superglue.
Speaker A
computer and physically destroyed real machines. It was discovered around 2010 and it had one target, a secret nuclear facility in Iran called Natans, [music] where Iran was enriching uranium. The US and Israel wanted it stopped, but without starting a war. So instead of
Speaker A
Stuxnet. Every virus so far messed with data, files, secrets, money. This one reached out of the computer and physically destroyed real machines. It was discovered around 2010, and it had one target, a secret nuclear facility in Iran called Natanz, where Iran was enriching uranium. The US and Israel wanted it stopped, but without starting a war. So instead of bombing it, they built a virus to break it from the inside.
Speaker A
So they got in the way we saw earlier, a USB stick carried inside by a spy or a tricked worker and plugged into a computer there. Once it was in, Stuckset went hunting. It ignored everything else and searched only for one very specific
Speaker A
The catch? The nuclear facility wasn't connected to the internet at all, on purpose. It was completely sealed off from the outside world so no hacker could ever reach it. So they got in the way we saw earlier: a USB stick carried inside by a spy or a tricked worker and plugged into a computer there. Once it was in, Stuxnet went hunting. It ignored everything else and searched only for one very specific thing: the exact machines that controlled the centrifuges.
Speaker A
those centrifuges and secretly sped them up way past their safe limit, then slammed them back down over and over, stressing the metal until they tore themselves apart. It physically shredded them from the inside. The best part is how it hid. While it was destroying the
Speaker A
And a centrifuge is basically a tall metal tube that spins uranium incredibly fast to purify it. These things are delicate, and they're built to spin at an exact speed. Stuxnet took control of those centrifuges and secretly sped them up way past their safe limit, then slammed them back down over and over, stressing the metal until they tore themselves apart. It physically shredded them from the inside.
Speaker A
showing everything was perfectly normal. Green lights, safe speeds, while in the next room, their machines were spinning themselves to death. By the time anyone realized, Stuckset had wrecked about a thousand centrifuges and set Iran's program back years. Carbon. Around 2013,
Speaker A
The best part is how it hid. While it was destroying the centrifuges, Stuxnet was also feeding fake readings to the scientists' monitors. Remember a heist movie where they loop the security camera footage so the guards see an empty room? That's exactly what it did. The engineers in the control room were staring at screens showing everything was perfectly normal. Green lights, safe speeds, while in the next room, their machines were spinning themselves to death. By the time anyone realized, Stuxnet had wrecked about a thousand centrifuges and set Iran's program back years.
Speaker A
to the bank's own network. Now, this is where most criminals would grab what they could and run. These guys did the opposite. They just waited for months.
Speaker A
Carbon. Around 2013, a group of hackers sent bank employees a normal-looking email with an attachment. An employee opened it thinking it was just bank business, and that let the Carbon virus in. The malware quietly installed itself and gave the hackers full access to the bank's own network.
Speaker A
transaction looks like, the exact rhythm of the place. They basically taught themselves how to be a bank employee.
Speaker A
Now, this is where most criminals would grab what they could and run. These guys did the opposite. They just waited for months. The malware was designed to let them secretly watch employees' screens, like a live security feed of staff doing their jobs. So they just sat there and studied how the bank moves money, what buttons the staff click, what a normal transaction looks like, the exact rhythm of the place. They basically taught themselves how to be a bank employee.
Speaker A
millions styled to look like ordinary bank transactions. Here's how they hit it. Say a customer had $1,000 in their account. The hackers would secretly change that number in the bank system to 10,000. They didn't add any real money.
Speaker A
And once they were familiar with the entire routine, they started stealing, but in a way that looked completely normal to the bank. They'd log into the money transfer system just like a real bank worker and quietly send themselves millions, styled to look like ordinary bank transactions. Here's how they hit it. Say a customer had $1,000 in their account. The hackers would secretly change that number in the bank system to 10,000. They didn't add any real money. They just faked the number. Then they'd quietly transfer out the extra 9,000 into their own accounts. The customer's balance would drop right back to the real 1,000, so the customer never noticed anything wrong. And since the account never went negative, the bank's alarms never went off.
Speaker A
alarms never went off. But their best trick was the ATMs. They could remotely order a cash machine to spit out its money at an exact time. So, at 3:00 p.m., a machine would just start dumping out cash, and a guy from the gang would
Speaker A
But their best trick was the ATMs. They could remotely order a cash machine to spit out its money at an exact time. So, at 3:00 p.m., a machine would just start dumping out cash, and a guy from the gang would casually stroll up, take the money, and walk off. No card, no hacking the machine itself. They hit over 100 banks across 30 countries and got away with around a billion dollars over roughly two years. And because every move was disguised as normal bank activity, most banks didn't even realize they'd been robbed unt
Speaker A
was disguised as normal bank activity, most banks didn't even realize they'd been robbed until investigators told them. Want to cry? Back in 2017, people all over the world turned on their computers and couldn't get in.
Speaker A
Everything was locked. All your files, your photos, your documents frozen shut and you couldn't open a single one. And there's a message sitting on the screen.
Speaker A
Pay $300 in Bitcoin or lose all of it with a countdown timer ticking down the whole time. If you wait too long, the price went up. Wait longer and everything got deleted. This is what's called ransomware. Instead of stealing
Speaker A
or deleting your files, it takes them hostage. What made W want to cry so bad was that it didn't need you to click anything. Normal viruses need you to open a bad file. This one didn't. Once it infected one computer on a network,
Speaker A
it copied [music] itself to every other computer automatically with nobody doing a thing. The tool it used to spread this way was called Eternal Blue, which was built by the NSA, the American Spy Agency, by the way. They found a flaw in
Speaker A
Windows and kept it secret to use themselves. Then hackers stole it from the NSA and leaked it online. So, Wukry was running on a stolen American cyber weapon. It hit over 200,000 computers in 150 countries in days. The worst hit was
Speaker A
the UK's health service. Hospitals got locked out of their own patient records. Surgeries were cancelled, ambulances turned away, and it was stopped almost by accident. A 22-year-old in England named Marcus Hutchkins was digging through the code and noticed it kept
Speaker A
trying to reach one random web address nobody owned. Curious, he registered it himself for about $10. The instant he did, Wry stopped dead worldwide. It was secretly designed to shut off if that address ever went live, a hidden kill
Speaker A
switch, and he flipped it by accident on his day off. The virus, by the way, is widely believed to have come from North Korea. My doom. In January 2004, this became the fastest spreading email virus ever, a record it still holds today. It
Speaker A
caused around $ 38 billion in damage, more than any virus before or since. Most viruses back then were bored kids showing off. But Maidoom was a paid job.
Speaker A
It hijacked hundreds of thousands of computers and turned them into what are called zombies. A zombie is an infected computer that keeps working normally for you while secretly taking orders from someone else in the background. Get an army of a few hundred thousand of those
Speaker A
and you can make them do anything you want at a massive scale or point all of them at a single target at once. And that was exactly the plan. On February 1st, 2004, every infected computer was secretly told to hit the same target at
Speaker A
the same time. a software company called SCO. Hundreds of thousands of computers started hammering its website all at once until it eventually crashed under the sheer amount of traffic. Then a later version turned the army on Microsoft itself. And to stop people
Speaker A
from fighting back, it blocked infected computers from even opening antiirus websites, so you couldn't download anything to clean it off. It even accidentally took down Google. A later version made infected computers secretly search Google over and over to hunt for
Speaker A
new email addresses to infect. And so many zombies were hammering it at once that Google started slowing down and occasionally throwing errors. The person behind it was never found. Half a million dollars in rewards, yet nobody could find him. The only clue was a line
Speaker A
buried in the code that said, "Andy, I'm just doing my job. Nothing personal. Sorry, nobody knows who Andy is, who built it, or who paid for it. And somehow, decades later, it's still faintly out there, still turning up in
Speaker A
inboxes from old infected machines that were never cleaned. Midi. By 2016, all of our homes were filling up with smart gadgets. Wi-Fi cameras, baby monitors, routers, smart doorbells, and a lot of them came with ridiculously simple default passwords like admin or 1 2 3 4
Speaker A
5 that people never bothered changing. Midi was [music] built to take advantage of exactly that. It scanned the internet looking for these devices, then tried a small list of common factory passwords.
Speaker A
And if someone had never changed theirs, Midi could just walk right in. The scary part was your camera or router would keep working like normal. You wouldn't see anything suspicious. But in the background, that device had quietly become part of a massive army waiting
Speaker A
for instructions. And Midi's army had more than 600,000 [music] infected devices that included real cameras, routers, and other gadgets sitting in people's homes all over the world. Then in October 2016, the attackers pointed that entire army at one target, a
Speaker A
company called Den. And Den was a big part of how people found websites on the internet. Let me explain. Every website lives on a server. And that server has a numerical address called the IP address.
Speaker A
It looks like this. This is the real location that your computer or browser needs to visit to access that website.
Speaker A
But you don't type this IP address. You type something like Netflix.com, the domain name. And DNS is the system that takes the name you typed and connects it to the IP behind it so that you can successfully access that website from
Speaker A
the server. And Den was one of the biggest companies providing this DNS service for websites like Twitter, Netflix, and Reddit. So when hundreds of thousands of hacked devices buried Den under junk traffic, that lookup stopped working. And because so many major
Speaker A
websites depended on Den, they started disappearing with it. Twitter, Netflix, Reddit, Spotify, PayPal, all suddenly became difficult or impossible to reach for millions of people. Triton. Every virus I've talked about so far wanted to steal something, break a machine, or
Speaker A
lock your files. This one was different. It could have killed people. In 2017, hackers broke into a prochemical plant in Saudi Arabia. And a place like this is no joke. It's full of high-press pipes, toxic [music] gas, and chemicals
Speaker A
that can explode if something goes wrong. That's why these plants have a separate system called a safety instrumented system or SIS. Think of it as the plant's emergency brake. It constantly watches things like pressure and temperature. And if something
Speaker A
becomes dangerous, it automatically shuts the plant down before things get out of control. They first broke into the plant's regular network, likely through a fishing email, and eventually made their way to a computer the engineers used to control the safety
Speaker A
system. From there, they found a hidden flaw in the safety controller that let them sneak their malware code into it.
Speaker A
And that's where things got terrifying. The hackers were trying to disable the safety system, then push the plant into a dangerous state. If the pressure suddenly spiked, the system wouldn't shut everything down. And if they pulled it off, the consequences could have been
Speaker A
catastrophic. a serious chemical release, a massive fire, even [music] an explosion that could have put workers lives at risk.
Speaker A
But then something went wrong. A bug in the hacker's own code triggered the safety system they were trying to disable. The plant shut down, engineers investigated, and they found the [music] malware. That mistake may have prevented a disaster. If you've made it this far,
Speaker A
comment your favorite moment from the video. And if you have any topic suggestions, [music] drop those down there, too. I might just pick one for the next video.
Topics:computer virusesmalware historyStuxnetWannaCryI Love You virusAgent.BTZcybersecurityransomwarebotnetcyber warfare
