fast16
fast16 is a previously undocumented cyber-sabotage malware framework whose oldest known components date to around 2005, predating Stuxnet. Public reporting cited in the content describes it as a precision sabotage platform built around a service binary, svcmgmt.exe, that embeds an early Lua 5.0 virtual machine and encrypted Lua payloads, plus a boot-start filesystem driver, fast16.sys, that intercepts executable code as it is read from disk and applies rule-based patches in memory. The framework is described as targeting high-precision engineering and physics simulation software rather than conventional espionage or broad destructive objectives.
High-confidence reporting in the content states that fast16 includes self-propagation functionality referred to as "wormlets." It spreads laterally over Windows network shares and via remote service creation, checks for the presence of security products before installation, and can install the fast16.sys kernel driver on target systems when those products are absent. The malware is described as operating in older Windows environments, particularly Windows 2000/XP-era systems.
The sabotage component selectively targets narrowly defined applications and modifies calculations in subtle, reproducible ways. Across the cited analyses, likely or confirmed targets include LS-DYNA and AUTODYN, with SentinelOne also identifying LS-DYNA 970, PKPM, and MOHID as probable targets. Symantec’s review, as summarized in the content, confirmed LS-DYNA and AUTODYN as targeted applications and described 101 byte-pattern hook rules grouped across multiple software builds. The malware activates only under specific simulation conditions and alters outputs such as pressure and Cauchy stress tensor values, including logic tied to high-explosive equation-of-state selections and density thresholds around 30 g/cm³. The stated effect is to silently corrupt simulation results, especially in high-explosive and uranium-compression modeling, in ways that could mislead researchers, delay programs, or contribute to engineering failure.
The content repeatedly characterizes fast16 as a state-grade sabotage capability and links its name to materials leaked by the Shadow Brokers that were widely believed to be associated with the NSA-linked Equation Group. However, attribution is not confirmed in the content. Multiple cited reports and researchers assess that the malware may have been intended to target Iranian nuclear-related research or weapons-development simulations, particularly through tampering with software allegedly used by Iranian nuclear scientists. The content also notes that fast16 was designed to infect multiple machines in the same environment so that verification on another local system would reproduce the same falsified results, making detection harder.
Known artifacts and identifiers directly mentioned in the content include the filenames svcmgmt.exe and fast16.sys, the string/name fast16 appearing in leaked Shadow Brokers materials, a PDB path referencing fast16.pdb, and the named pipe \.\pipe\p577. The content also mentions vendor detections including Microsoft Trojan:WinNT/FastSixteen.A!dha and Kaspersky Trojan.Win32.Fast16.a.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Security researchers have uncovered fast16, a highly specialized sabotage framework whose oldest software components appear to date back to roughly 2005—pre-dating Stuxnet’s deployment by nearly two years.
Security researchers have uncovered a cyber-sabotage platform that predates Stuxnet by at least half a decade... Fast16 was designed to corrupt floating-point calculations in a subtle, predictable, reproducible way.
Researchers have uncovered a malware framework dubbed "fast16" that predates Stuxnet by 5 years... Fast16's function was to quietly corrupt mathematical outputs of engineering and scientific software by introducing tiny systematic errors... SentinelOne described it as the first-ever Lua-based network worm targeting high-precision calculation software.
Techniques & procedures
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesFor machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
The researchers analyzed the sample and found it tries to install a worm and deploy a driver called fast16.sys.
Their investigation uncovered malware dating back to 2005 that was reportedly designed to manipulate software believed to be used by Iranian nuclear scientists...
Execution
3 techniques...report new share connections back via the named pipe \\.\pipe\p577.
No arguments runs it as a Windows service... registers itself as the SvcMgmt service... and creates a remote SvcMgmt service to start execution on the new host.
The framework consists of a service binary that embeds an early Lua 5.0 virtual machine, a boot-start filesystem driver that intercepts and patches executable code as it is read from disk, and a rule-driven hook engine that rewrites very specific instruction sequences inside a single, narrowly defined target application.
Persistence
5 techniquesFor machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
The Lua code provides fast16's main execution behavior through 13 libraries covering host operations, remote service control, registry manipulation... configures the registry to load it as a SCSI-class filter driver on the next boot.
No arguments: Runs as a Windows service. -p : Sets InstallFlag = 1 and runs as a service (Propagate/Install & Run). ... Escalates privileges and installs the carrier executable as the SvcMgmt service, then starts it.
For persistence, fast16 abuses Image File Execution Options by writing its own path into the Debugger value under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>, which causes Windows to launch fast16 instead of the chosen application.
Privilege Escalation
5 techniquesThat kernel driver then reads the code of applications as they're loaded into the computer's memory, monitoring for a long list of specific patterns—“rules” that allow it to identify when a target application is running. When it detects the target software, it carries out its apparent goal: silently altering the calculations the software is running to imperceptibly corrupt its results.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
Fast16 propagates within a target network using share enumeration and impersonation... fast16 impersonates the locally logged-on user's credentials
No arguments: Runs as a Windows service. -p : Sets InstallFlag = 1 and runs as a service (Propagate/Install & Run). ... Escalates privileges and installs the carrier executable as the SvcMgmt service, then starts it.
For persistence, fast16 abuses Image File Execution Options by writing its own path into the Debugger value under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>, which causes Windows to launch fast16 instead of the chosen application.
Stealth
10 techniquesThe framework consists of a service binary that embeds an early Lua 5.0 virtual machine, a boot-start filesystem driver that intercepts and patches executable code as it is read from disk... Once the driver is installed, it creates a kernel file system filter to monitor all accessed files.
Under the install flags, fast16 copies itself to %windir%\system32\svcmgmt.exe, timestamps the file by cloning creation dates and ACL permissions from services.exe... It then drops the fast16.sys kernel driver into the system drivers folder, matches its timestamps to beep.sys
That kernel driver then reads the code of applications as they're loaded into the computer's memory, monitoring for a long list of specific patterns—“rules” that allow it to identify when a target application is running. When it detects the target software, it carries out its apparent goal: silently altering the calculations the software is running to imperceptibly corrupt its results.
On execution, the malware deletes that registry key, launches the original application, re-adds the key to maintain persistence...
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
Fast16 propagates within a target network using share enumeration and impersonation... fast16 impersonates the locally logged-on user's credentials
On execution, the malware deletes that registry key, launches the original application, re-adds the key to maintain persistence, and then re-runs itself with the 'r' command-line argument for normal execution. The user sees a working application while the hijack is silently restored.
The core sabotage logic only activated under narrow conditions. Fast16 first verified that a supported simulator was running and that a scenario matched high‑explosive implosion tests consistent with a spherical uranium core design.
Fast16 is crafted such that it will not infect computers that have certain security products installed.
The framework consists of a service binary that embeds an early Lua 5.0 virtual machine, a boot-start filesystem driver that intercepts and patches executable code as it is read from disk, and a rule-driven hook engine that rewrites very specific instruction sequences inside a single, narrowly defined target application.
Defense Impairment
2 techniquesThe Lua code provides fast16's main execution behavior through 13 libraries covering host operations, remote service control, registry manipulation... configures the registry to load it as a SCSI-class filter driver on the next boot.
Credential Access
1 techniqueDiscovery
5 techniquesThe driver waits silently until EXPLORER.EXE initializes... The hooks for Mechanism B specifically targeted LS-DYNA runs. The malware scanned volatile memory to see if the user selected specific mathematical models designed for modeling high-explosive behavior.
The driver waits silently until EXPLORER.EXE initializes and then maps out files compiled with the Intel Fortran or C++ compilers.
In parallel, fast16 enumerates all domains, servers, and shares to discover further remote hosts.
Fast16 is crafted such that it will not infect computers that have certain security products installed.
It checks for a list of security applications, and if none are present, installs the Fast16.sys kernel driver on the target machine.
Lateral Movement
4 techniquesFor machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
The researchers analyzed the sample and found it tries to install a worm and deploy a driver called fast16.sys.
Using what was referred to within the code as “wormlet” functionality, Fast16 is designed to copy itself to other computers on the network via Windows’ network share feature.
Impact
2 techniquesBefore this workflow runs, a pre-installation kill-switch checks the environment. The ok_to_install() routine calls ok_to_propagate() and propagation is only allowed if it’s manually forced or if it’s made sure common security products aren’t found by checking for associated registry keys. The routine walks a list of vendor keys and aborts installation if any of them are present, preventing deployment into monitored environments.
The hooks fast16 places inside of the simulation program consist of three attack strategies... All the tampering mechanisms effectively reduce the output values such as the Cauchy stress tensor to disrupt the simulation.
Other
1 techniqueIOCs tracked for this family
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A project name found in leaked Shadow Brokers materials; researchers reportedly identified it as malware dating back to 2005 designed to manipulate software believed to be used by Iranian nuclear scientists.
A leaked malware project dating to 2005, designed to tamper with software allegedly used by Iranian nuclear scientists.
A highly specialized sabotage framework designed to compromise engineering software used for high-explosive and impact-physics simulations. It drops a kernel-level file system filter driver, hooks targeted applications such as LS-DYNA and AUTODYN, injects an early Lua 5.0 virtual machine, and subtly corrupts thermodynamic simulation outputs related to uranium-compression modeling central to nuclear weapon design.
A cyber sabotage framework designed to target high-precision engineering and simulation software such as LS-DYNA, AUTODYN, PKPM, and MOHID. It uses an embedded Lua virtual machine for modularity and a kernel-mode filesystem driver to intercept executables in memory and patch floating-point arithmetic routines, causing inaccurate simulation and modeling results that could sabotage sensitive engineering or research outcomes.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.