Here’s a closer look at the 417 data structures. If you follow this blog closely, you will remember that we posted details on the man in the middle on Nov 24. Go back to that post and have another look at FC 6069. FC 6069 stores 984 inputs in an array in DB 8063.
This array is structured as 164 x 6 entries. The attack code operates on these entries more than once. See for example what FC 6068 does (pseudo-coded from the original STL attack code):
FC 6068 is called from FC 6070 six times, passing values from 1 to 6. Funny enough, 164 centrifuges are in one IR-1 cascade. Six cascades translate to 984 centrifuges.
Now go back to the ISIS report. The number of damaged cascades is six. That’s how you arrive at the “about 1,000 centrifuges”. The exact number is 984. Bottom line: We bet a gefilte fish that the damaged centrifuges were attached to one infected 417.