The hard part is not in knowing how to construct the actual bomb. The hard part is enriching the requisite quantity of a fissile material.

That's why the US and Israel went after Iran's enrichment facilities with Stuxnet.

They are easy from an 'intelligence required' perspective. They are difficult from a logistics perspective.

Relatively easy, i.e. compared to viruses.

Stuxnet, for one. Also, the realization that having a nuclear weapon when you're Iran is a terribly bad idea, from a diplomatic standpoint.

Being caught making one is a terribly bad idea. Having one (or more) would be an enormous plus from a diplomatic standpoint especially after a test, having them in undisclosed locations and too many to knock them all out in one strike is even better. Not that that's a world we should prefer to live in but history has shown that the quickest way to increase your diplomatic clout as a nation is to join the nuclear club.

The tech is (relatively) easy, it's getting that materials that is (fortunately) hard. But there is enough of it in enough places with imperfect oversight that it is a source of concern.