Researchers Uncover 'fast16' Malware: A Pre-Stuxnet Sabotage Framework Targeting Engineering Software

TL;DR: Researchers from SentinelOne have discovered a sophisticated cyber-sabotage framework named fast16 that predates the infamous Stuxnet worm by at least five years. Attributed to the NSA-linked Equation Group, this malware utilized a Lua engine as early as 2005 to hijack high-precision engineering software like LS-DYNA to corrupt mathematical calculations. The discovery suggests that state-sponsored digital weaponry for physical sabotage was fully developed and potentially deployed years before we previously thought.

---

The Discovery: Rewriting Cybersecurity History

For over a decade, the Stuxnet worm was considered the world's first true digital weapon—a piece of code designed to cause physical destruction in the real world. However, a new report published by SentinelOne researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade has fundamentally shifted this timeline.

Researchers have uncovered fast16, a previously undocumented sabotage framework with artifact timestamps dating back to July and August 2005. This puts its development at least five months before the earliest known iterations of Stuxnet (version 0.5) and years before the world became aware of such capabilities.

Technical Analysis: The First Lua-Powered Malware

One of the most surprising technical findings is that fast16 is the first known Windows malware strain to embed a Lua engine.

• Carrier Module: The malware uses a file named svcmgmt.exe, which acts as a "carrier." Inside this module, researchers found an embedded Lua 5.0 virtual machine and an encrypted bytecode container.
• Encrypted Logic: By using Lua—a lightweight programming language often used in game development—the attackers were able to separate the stable execution wrapper from the task-specific logic. This allowed them to adapt the malware to different target environments without changing the outer binary.
• The Kernel Driver: The core sabotage occurs via fast16.sys, a kernel driver designed for precision patching.

Note for Developers: A kernel driver operates at the most privileged level of the operating system (Ring 0), allowing it to intercept system calls and modify files as they are read from the disk.

Target: High-Precision Sabotage

Unlike "typical" malware designed to steal credit card data or passwords, fast16 had a much more sinister objective: mathematical corruption.

The malware's patching engine contains 101 rules specifically designed to hijack the execution flow of software compiled with the Intel C/C++ compiler. Based on research, the primary targets appear to be high-precision engineering and simulation suites:

1. LS-DYNA 970: Used for simulating crashes, explosions, and impacts.
2. PKPM: Structural engineering software.
3. MOHID: A hydrodynamic modeling platform.

By introducing small, systematic errors into these simulations, the attackers could cause engineered systems to fail over time or even lead to catastrophic physical damage without the users realizing the results were tampered with.

The Connection to the Equation Group

The forensic link connecting fast16 to the Equation Group (an APT group widely linked to the NSA) comes from a leak by the mysterious group known as The Shadow Brokers.

In the 2017 "Lost in Translation" leak, a file named drv_list.txt contained a list of drivers used in APT operations. The string "fast16" found in svcmgmt.exe matches the deconfliction signatures in that leaked list, providing a high-confidence link between this 2005 era malware and US-linked intelligence operations.

Historical Context: Targeting the Iranian Nuclear Program?

While it is not confirmed if fast16 was deployed in a live environment, there is compelling evidence regarding its intended target.

A report from the Institute for Science and International Security (ISIS) indicates that Iran likely used LS-DYNA (a fast16 target) for modeling related to nuclear weapons development. Given that the same actors behind fast16 later deployed Stuxnet against the Natanz uranium enrichment facility, it is highly probable that fast16 was a precursor or a pilot project aimed at the same Iranian research interests.

Mitigations and Legacy

Because of its age, the fast16.sys kernel driver is incompatible with Windows 7 and later versions. However, the discovery serves as a reminder of the longevity of state-sponsored tools.

• Legacy Systems: Organizations still running Windows 2000 or Windows XP are at risk from this specific framework.
• Modern EDR: The malware explicitly scans the Windows Registry to check for security products from vendors like Kaspersky, McAfee, and Symantec to avoid detection. Modern Endpoint Detection and Response (EDR) tools are designed to catch this type of behavior.
• Credential Hygiene: The malware included a "wormlet" designed to propagate across networks with weak or default credentials via the Service Control Manager (SCM).

Conclusion

The discovery of fast16 proves that the era of digital sabotage began much earlier than 2010. It showcases a high level of sophistication—using Lua for modularity and kernel drivers for precision patching—long before these techniques became common in the broader malware landscape. For Moroccan security practitioners, it highlights the importance of protecting engineering environments and the risks inherent in legacy industrial software.

Source: The Hacker News - Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software