SentinelOne Finds 2005 Malware Designed to Corrupt Scientific Calculations
Summary
SentinelOne researchers say fast16, a Lua-based malware framework dating to 2005, was designed to subtly corrupt scientific and engineering calculations. Its deployment and impact are unknown; it runs only on obsolete uniprocessor Windows XP systems.
Key points
- SentinelOne researchers discovered fast16, with components dating to 2005, while investigating early use of embedded Lua in Windows malware.
- The framework was designed to introduce subtle, systematic errors into high-precision scientific and engineering calculations.
- Its “cluster munition” delivery method used multiple wormlets to spread the main payload across target environments.
- Researchers identified LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform as likely targets.
- Fast16 runs only on uniprocessor Windows XP systems; researchers say it is incapable of running on modern systems.
- Researchers do not know whether fast16 was deployed or what its intended targets or real-world impact were. SentinelOne published YARA rules for checking older systems or data archives.
Article Details
- Event Type
- Discovery of fast16, a previously undocumented malware framework designed to subtly corrupt high-precision scientific and engineering calculations.
- Impact
- fast16 could undermine the integrity of calculation outputs by introducing subtle errors. The researchers said it runs only on obsolete uniprocessor Windows XP systems; whether it was ever deployed or caused harm is unknown. The article notes that the underlying sabotage approach could remain relevant if modernized.
People
Malware
Products
LS-DYNA 970The tool predates Stuxnet, used a “cluster munition” wormlet delivery to spread, and targeted packages like LS-DYNA 970, PKPM, and MOHID, showing this sabotage vector remains relevant today.MOHIDThe tool predates Stuxnet, used a “cluster munition” wormlet delivery to spread, and targeted packages like LS-DYNA 970, PKPM, and MOHID, showing this sabotage vector remains relevant today.PKPMThe tool predates Stuxnet, used a “cluster munition” wormlet delivery to spread, and targeted packages like LS-DYNA 970, PKPM, and MOHID, showing this sabotage vector remains relevant today.Windows XPThe malware runs on obsolete uniprocessor Windows XP systems, but the underlying high-precision sabotage vector remains relevant and YARA rules have been published for detection.
Tools
Countries
Industries
EngineeringSentinelOne researchers uncovered fast16, a previously undocumented Lua-based malware framework from 2005 designed to corrupt high-precision scientific and engineering calculations.Nuclear researchhigh-precision computing workloads of national importance like advanced physics, cryptographic, and nuclear research workloads.”