Loading malware…
fast16 is a highly specialized Windows sabotage framework whose oldest known components date to around 2005, making it an early example of precision cyber sabotage that predates Stuxnet. Rather than directly manipulating industrial controllers or machinery, it is designed to spread within Windows networks and silently corrupt the outputs of selected high-precision engineering and physics simulation software. Public analysis has linked its targeting most strongly to LS-DYNA and AUTODYN, with earlier candidate overlap also noted for PKPM and MOHID. The malware’s behavior and trigger conditions indicate an intent to tamper with simulations involving high explosives and uranium-compression physics relevant to nuclear weapons research.
The framework consists of a service component, an embedded Lua-based operational layer, and a boot-start filesystem driver with a rule-driven patching engine. The driver intercepts executable code as targeted applications are loaded, identifies narrowly defined Intel-compiled binaries, and rewrites specific instruction sequences on the fly using a large set of byte-pattern rules grouped across multiple software builds. Its sabotage logic activates only under tightly constrained simulation conditions, including particular equation-of-state selections and density thresholds associated with implosion-style compression, then scales down selected pressure- or stress-related outputs so results remain plausible while becoming scientifically misleading. This selective corruption suggests deep knowledge of both the target software internals and the modeled physical processes.
fast16 also includes worm-like propagation inside local Windows environments. It can enumerate network resources, copy itself through administrative shares, impersonate the logged-on user, and create remote services to install on additional hosts, while restricting spread to local network ranges. It checks for the presence of certain security products before propagating or installing, reflecting deliberate stealth and operational restraint. Persistence has been associated with service-based execution, a boot-start driver, and Image File Execution Options abuse.
Researchers have assessed fast16 as a state-grade sabotage platform and have compared it conceptually to Stuxnet because both aim to undermine trusted technical processes through subtle, domain-specific manipulation rather than overt destruction. Multiple analyses have suggested likely relevance to Iranian nuclear-weapons-related modeling workflows, but definitive public attribution to a specific state or threat actor remains unconfirmed.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Security researchers have uncovered fast16, a highly specialized sabotage framework whose oldest software components appear to date back to roughly 2005—pre-dating Stuxnet’s deployment by nearly two years.
Security researchers have uncovered a cyber-sabotage platform that predates Stuxnet by at least half a decade... Fast16 was designed to corrupt floating-point calculations in a subtle, predictable, reproducible way.
Researchers have uncovered a malware framework dubbed "fast16" that predates Stuxnet by 5 years... Fast16's function was to quietly corrupt mathematical outputs of engineering and scientific software by introducing tiny systematic errors... SentinelOne described it as the first-ever Lua-based network worm targeting high-precision calculation software.
45 distinct techniques documented for this family, organized by ATT&CK tactic.
SentinelOne likened fast16's delivery mechanism to a "cluster munition" that could drop multiple "wormlets" which would then distribute the main payload to as many machines as possible in a target environment by looking for and exploiting vulnerabilities in them.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
The researchers analyzed the sample and found it tries to install a worm and deploy a driver called fast16.sys.
SentinelOne likened fast16's delivery mechanism to a "cluster munition" that could drop multiple "wormlets" which would then distribute the main payload to as many machines as possible in a target environment by looking for and exploiting vulnerabilities in them.
Their investigation uncovered malware dating back to 2005 that was reportedly designed to manipulate software believed to be used by Iranian nuclear scientists...
Its primary function was to sabotage precision calculation tools used in fields like civil engineering and physics by introducing systematic errors into calculations... It targeted specific engineering and simulation suites, including LS-DYNA, PKPM, and the MOHID platform.
...report new share connections back via the named pipe \\.\pipe\p577.
No arguments runs it as a Windows service... registers itself as the SvcMgmt service... and creates a remote SvcMgmt service to start execution on the new host.
fast16 contains a program of 101 byte-pattern rules that recognize locations inside an executable, capture addresses, replace code, and repair the executable metadata those changes require.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
The Lua code provides fast16's main execution behavior through 13 libraries covering host operations, remote service control, registry manipulation... configures the registry to load it as a SCSI-class filter driver on the next boot.
On the surface, svcmgmt.exe appears to be a Windows service implant with two embedded components.
For persistence, fast16 abuses Image File Execution Options by writing its own path into the Debugger value under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>, which causes Windows to launch fast16 instead of the chosen application.
The svcmgmt.exe component is responsible for tasks like copying payload files, setting up service entries, and preparing registry values that define how and when the malware should run.
The aforementioned svcmgmt.exe acts as a carrier worm for delivering the fast16.sys kernel driver.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
That kernel driver then reads the code of applications as they're loaded into the computer's memory, monitoring for a long list of specific patterns—“rules” that allow it to identify when a target application is running. When it detects the target software, it carries out its apparent goal: silently altering the calculations the software is running to imperceptibly corrupt its results.
The presence of signed or otherwise legitimate-looking components, as well as detailed logic for installing services and drivers, suggests that the operators expect to work with elevated privileges on domain-joined systems, possibly after using other tools and techniques to gain initial footholds.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
Fast16 propagates within a target network using share enumeration and impersonation... fast16 impersonates the locally logged-on user's credentials
On the surface, svcmgmt.exe appears to be a Windows service implant with two embedded components.
For persistence, fast16 abuses Image File Execution Options by writing its own path into the Debugger value under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>, which causes Windows to launch fast16 instead of the chosen application.
The svcmgmt.exe component is responsible for tasks like copying payload files, setting up service entries, and preparing registry values that define how and when the malware should run.
The aforementioned svcmgmt.exe acts as a carrier worm for delivering the fast16.sys kernel driver.
A kernel driver easily mistaken for a filesystem rootkit actually contains a patching engine with 101 rules...
The analysis led to a 2005 sample, svcmgmt.exe, which contained an embedded Lua VM and encrypted bytecode.
Under the install flags, fast16 copies itself to %windir%\system32\svcmgmt.exe, timestamps the file by cloning creation dates and ACL permissions from services.exe... It then drops the fast16.sys kernel driver into the system drivers folder, matches its timestamps to beep.sys
That kernel driver then reads the code of applications as they're loaded into the computer's memory, monitoring for a long list of specific patterns—“rules” that allow it to identify when a target application is running. When it detects the target software, it carries out its apparent goal: silently altering the calculations the software is running to imperceptibly corrupt its results.
This driver, designed for pre-Windows 7 systems, manipulated filesystem I/O and employed rule-based code patching... included environmental awareness to avoid monitored systems.
On execution, the malware deletes that registry key, launches the original application, re-adds the key to maintain persistence...
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
Fast16 propagates within a target network using share enumeration and impersonation... fast16 impersonates the locally logged-on user's credentials
On execution, the malware deletes that registry key, launches the original application, re-adds the key to maintain persistence, and then re-runs itself with the 'r' command-line argument for normal execution. The user sees a working application while the hijack is silently restored.
The core sabotage logic only activated under narrow conditions. Fast16 first verified that a supported simulator was running and that a scenario matched high‑explosive implosion tests consistent with a spherical uranium core design.
The malware propagated through weak passwords on file shares and included environmental awareness to avoid monitored systems.
Fast16 is crafted such that it will not infect computers that have certain security products installed.
fast16 contains a program of 101 byte-pattern rules that recognize locations inside an executable, capture addresses, replace code, and repair the executable metadata those changes require.
The Lua code provides fast16's main execution behavior through 13 libraries covering host operations, remote service control, registry manipulation... configures the registry to load it as a SCSI-class filter driver on the next boot.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
fast16 contains a program of 101 byte-pattern rules that recognize locations inside an executable, capture addresses, replace code, and repair the executable metadata those changes require.
Because Fast16 propagated laterally across internal networks and refused to run on hosts with certain security tools, any workstation used to run these simulations could quietly return the same misleading results.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
the propagation only occurs when it's manually forced, or common security products aren't found on the system by scanning the Windows Registry database for associated registry keys
launch a Service Control Manager (SCM) wormlet that scans for network servers and propagates the malware to other Windows 2000/XP environments with weak or default credentials
The driver waits silently until EXPLORER.EXE initializes... The hooks for Mechanism B specifically targeted LS-DYNA runs. The malware scanned volatile memory to see if the user selected specific mathematical models designed for modeling high-explosive behavior.
Embedded configuration and code show that the authors anticipated encounters with various personal firewall and security products, checking for related registry keys and adapting behavior when such software is present.
The driver waits silently until EXPLORER.EXE initializes and then maps out files compiled with the Intel Fortran or C++ compilers.
In parallel, fast16 enumerates all domains, servers, and shares to discover further remote hosts.
The malware propagated through weak passwords on file shares and included environmental awareness to avoid monitored systems.
Fast16 is crafted such that it will not infect computers that have certain security products installed.
It checks for a list of security applications, and if none are present, installs the Fast16.sys kernel driver on the target machine.
it would check the machine registry for signs of malware monitoring tools from companies like Symantec, TrendMicro, McAfee, etc., to decide whether to abort or to deploy.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
The researchers analyzed the sample and found it tries to install a worm and deploy a driver called fast16.sys.
It spreads through Windows networks and quietly corrupts the output of engineering simulation software.
We recently published our research on fast16, a 2005 Windows toolkit built to sabotage high-precision solvers used to model nuclear-weapons behavior.
Before this workflow runs, a pre-installation kill-switch checks the environment. The ok_to_install() routine calls ok_to_propagate() and propagation is only allowed if it’s manually forced or if it’s made sure common security products aren’t found by checking for associated registry keys. The routine walks a list of vendor keys and aborts installation if any of them are present, preventing deployment into monitored environments.
Fast16 malware, detailed by SentinelOne’s SentinelLabs in April, is a 2005 Windows malware designed to interfere with LS-DYNA, engineering software that appears to have been used by Iran as part of its nuclear weapons development program.
The hooks fast16 places inside of the simulation program consist of three attack strategies... All the tampering mechanisms effectively reduce the output values such as the Cauchy stress tensor to disrupt the simulation.
Researchers have uncovered a malware framework dubbed "fast16" that predates Stuxnet by 5 years... capable of injecting near-imperceptible errors into high-precision mathematical computations to gradually undermine and sabotage systems and applications that rely on their results.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.