Fast16 Malware Was Built to Alter Nuclear-Weapons Simulations, Researchers Say
Summary
Researchers say Fast16, whose components may date to around 2005, used tailored hooks to alter LS-DYNA and AUTODYN high-explosive and uranium simulation outputs. It spread within networks through services, IFEO persistence and remote shares.
Key points
- SentinelOne published the first analysis of Fast16 in April 2026; some components may date to around 2005.
- Symantec's Threat Hunter Team identified LS-DYNA and AUTODYN as the targeted simulation applications.
- Fast16 used 101 byte-pattern rules, grouped for different software builds, to hook and modify selected instructions as executables were read.
- The hooks checked simulation conditions, including equation-of-state settings and material density; some mechanisms altered pressure or stress outputs when uranium density reached 30 g/cm³.
- The researchers say the targeted models and tampering behavior indicate an intent to disrupt high-explosive and nuclear detonation simulations. How users responded to altered results remains unclear.
- Fast16 spread within networks using service installation, IFEO persistence, share enumeration and credential impersonation; the article says it was designed not to spread outside the target network.
- The article recommends regular driver inventory and application control, and discusses endpoint security tools as potential defenses.
Article Details
- Attack Vectors
- Fast16 installs as a Windows service and drops a boot-start filesystem driver that monitors files and patches matching executable code as it is read.
- It uses Image File Execution Options Debugger values to hijack selected applications for persistence, then launches the original application and restores the persistence key.
- For lateral spread within the target network, Fast16 enumerates domains, servers, and shares, impersonates the locally logged-on user's credentials, copies itself to remote administrative shares, and starts a remote service.
- The hook engine targets LS-DYNA and AUTODYN simulations. It modifies selected output values when specified simulation conditions are met, including uranium density reaching 30 g/cm³.
- Defensive Notes
- Regularly inventory loaded drivers and flag unsigned or unfamiliar drivers.
- Deploy and tightly tune application control to block unapproved executables and DLLs.
- The article recommends Symantec Endpoint Security and Carbon Black EDR, and enabling Symantec Endpoint Security Adaptive Protection.
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesFast16 copies itself to remote administrative shares, including the admin$ share, during propagation.T1049 · System Network Connections DiscoveryFast16 enumerates domains, servers, and shares to discover additional remote hosts.T1055 · Process InjectionFast16's hook engine places malicious code in an injected .xdata section and redirects execution to injected handlers when matching executable code is read.T1134.002 · Create Process with TokenBefore copying itself to remote machines, Fast16 impersonates the locally logged-on user's credentials.T1547.012 · Print ProcessorsFast16 persists by writing its path to the Debugger value under Image File Execution Options so Windows launches it instead of the selected application.T1569.002 · Service ExecutionFast16 registers and runs as the SvcMgmt Windows service and creates a remote SvcMgmt service to execute on additional hosts.
Malware
Vendors
Carbon BlackDefensive guidance includes driver inventory, application control, and endpoint security tools like Symantec Endpoint Security and Carbon Black EDR.SymantecDefensive guidance includes driver inventory, application control, and endpoint security tools like Symantec Endpoint Security and Carbon Black EDR.
Products
ANSYS AUTODYNFast16 is a long-running sabotage framework that targets LS-DYNA and AUTODYN simulations to manipulate high-explosive and nuclear detonation modeling, especially by altering output values when uranium density reachesCarbon Black EDRDefensive guidance includes driver inventory, application control, and endpoint security tools like Symantec Endpoint Security and Carbon Black EDR.LS-DYNAFast16 is a long-running sabotage framework that targets LS-DYNA and AUTODYN simulations to manipulate high-explosive and nuclear detonation modeling, especially by altering output values when uranium density reachesMicrosoft WindowsFile Execution Options – Fast16 abuses IFEO persistence by writing its path into a Debugger value so Windows launches it instead of the target application (‘writing its own path into the Debugger value underSymantec Endpoint SecurityDefensive guidance includes driver inventory, application control, and endpoint security tools like Symantec Endpoint Security and Carbon Black EDR.