The Congress did not give the Executive branch this power by any sort of law that I can recall
Who said this was limited to the US government? You are talking about against US citizens by the US government, a very select case. Several countries can spy on their own citizens "by law", China for instance. It's quite legal there. So, that immediately would contradict your statement "It's an illegal activity, whether done by governments or by the mob." Because it's just not true on its face.
We are not aware which country did this, unlike Stuxnet. So let's look at Stuxnet, which was created by the US and Israel. The CIA operates under similar legality to operate on foreign agents and powers. Why does Stuxnet differ from an agent sneaking in and sabotaging a machine?
In what way is Stuxnet, targetted at Iran, crimeware under US law. Sometimes laws give explicit powers. Other times, powers are assumed unless explicitly prohibited.
Something is not simply illegal where the law is silent.
So, assuming Stuxnet was an operation carried out by the US government against the Iran government, and assuming that it operated as intended, namely that it never left Iranian facilities... show me the law, the exact law, that makes it illegal.
You are sort of blandly making these assumptions of legality... without anything legal backing. If you were to take the makers of Stuxnet to court, what law would you go to SCOTUS charging them with if you were Iran?
You can't just throw "not done under the rule of law" out there. That's some libertarian, "government can't do anything unless we spell it out in exact detail to them, with no wiggle room", jargon. And, you may very well be a libertarian and believe that. Unfortunately for that argument, neither the US government nor the courts nor China nor Russia nor many other countries with cyberwar programs take such a view on the law.
That leaves it as thinking is should be illegal, but that's opinion, not law.