SentinelOne Uncovers 2005 Lua Malware Framework Targeting Engineering Software
Summary
SentinelOne researchers describe fast16, a Lua-based Windows framework dating to 2005. Its kernel driver could alter engineering and simulation software calculations; the investigation details its components and propagation, and places it before Stuxnet.
Key points
- SentinelOne says fast16 dates to 2005 and embeds a Lua 5.0 virtual machine with encrypted bytecode.
- The svcmgmt.exe carrier could run as a Windows service, execute Lua code and deploy the auxiliary svcmgmt.dll and fast16.sys driver.
- The driver intercepted and patched Intel C/C++-compiled executables to corrupt calculations; it does not run on Windows 7 or later.
- An SCM wormlet could propagate to Windows 2000/XP servers using weak or default credentials. Propagation was manually triggered or conditioned on security products not being detected.
- Analysis of 101 patching rules led researchers to assess LS-DYNA 970, PKPM and MOHID as possible targets, not confirmed targets.
- SentinelOne found a fast16 reference in a leaked driver list associated with Shadow Brokers disclosures of material allegedly stolen from the Equation Group; this does not establish attribution.
Article Details
- Attack Vectors
- The svcmgmt.exe carrier could run as a Windows service and execute Lua payloads.
- When manually forced or when listed security products were not detected in the Windows Registry, an SCM wormlet scanned for servers and propagated to Windows 2000/XP systems with weak or default credentials.
- The fast16.sys driver intercepted and patched code in Intel C/C++-compiled executables, corrupting calculations in engineering and simulation software.
- The ConnotifyDLL was invoked on new Remote Access Service network connections and wrote local and remote connection names to a named pipe.
- Defensive Notes
- The article reports that propagation checked the Windows Registry for security products from vendors including Agnitum, F-Secure, Kaspersky, McAfee, Microsoft, Symantec, Sygate Technologies, and Trend Micro.
- The article states that fast16.sys would not run on Windows 7 or later.
- The article provides no specific remediation guidance.
MITRE ATT&CK
T1018 · Remote System DiscoveryThe SCM wormlet scanned for network servers before propagating to other Windows 2000/XP environments.T1059 · Command and Scripting InterpreterThe carrier could execute Lua code, with its core logic and payload behavior implemented in Lua bytecode.T1105 · Ingress Tool TransferThe SCM wormlet propagated the malware to other Windows 2000/XP environments.T1518.001 · Security Software DiscoveryThe malware checked Windows Registry keys for installed security products before propagating.T1543.003 · Windows ServiceThe svcmgmt.exe carrier could configure itself to run as a Windows service.T1565.001 · Stored Data ManipulationThe fast16.sys driver patched executable code as it was read from disk, corrupting calculations in targeted engineering and simulation software.
People
Juan Andrés Guerrero-SaadeA SentinelOne researcher credited with analyzing fast16 and co-authoring the report describing its components and sabotage behavior.Vitaly KamlukA SentinelOne researcher credited with analyzing fast16 and co-authoring the report describing its components and sabotage behavior.
Threat Actors
Equation GroupThe article describes Equation Group as an APT with suspected ties to the U.S. National Security Agency and says The Shadow Brokers published data allegedly stolen from it. The fast16 reference in a leaked driver list does not establish that Equation Group developed or operated fast16.The Shadow BrokersThe article identifies this group as the publisher of data allegedly stolen from the Equation Group, including the leaked driver list containing a reference to fast16.
Malware
DuquFast16 is assessed to predate Stuxnet, the first known digital weapon engineered for disruptive actions, and which served as the basis for the Duqu information stealer rootkit, by at least five years.fast16Researchers at SentinelOne uncovered a previously undocumented Lua-based Windows sabotage framework called fast16 that dates to 2005 and embeds a Lua 5.0 virtual machine with encrypted bytecode.FlameIt also precedes the earliest known samples of Flame (aka Flamer and Skywiper), another sophisticated malware that was discovered in 2012, incorporating a Lua virtual machine to realize its goals.FlamerIt also precedes the earliest known samples of Flame (aka Flamer and Skywiper), another sophisticated malware that was discovered in 2012, incorporating a Lua virtual machine to realize its goals.SkywiperIt also precedes the earliest known samples of Flame (aka Flamer and Skywiper), another sophisticated malware that was discovered in 2012, incorporating a Lua virtual machine to realize its goals.StudentWhat’s more, Symantec revealed in February 2013 an earlier version of Student that was used to attack Iran’s nuclear program in November 2007, with evidence indicating it was under development as early as November 2005.Stuxnetpropagate across Windows 2000/XP networks, a finding that predates and recontextualizes later tools like Stuxnet.Stuxnet 0.5“Stuxnet 0.5 is the oldest known Stuxnet version to be analyzed,” Symantec noted at the time.
Vendors
AnsysLS-DYNA, now part of the Ansys Suite, is a general-purpose multi physics simulation software package that’s used for simulating crashes, impacts, and explosions.IntelThe fast16.sys kernel driver performs rule-based patching of Intel C/C++ compiled executables to corrupt mathematical and simulation results.MicrosoftSome of the security tools it explicitly checks belong to Agnitum, F-Secure, Kaspersky, McAfee, Microsoft, Symantec, Sygate Technologies, and Trend Micro.
Products
LS-DYNA 970it’s assessed that three high-precision engineering and simulation suites may have been the targets: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform.MOHIDhigh-precision engineering and simulation suites may have been the targets: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform.PKPMthat three high-precision engineering and simulation suites may have been the targets: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform.Windows 2000a kernel driver (fast16.sys) to intercept and corrupt high-precision calculations and propagate across Windows 2000/XP networks, a finding that predates and recontextualizes later tools like Stuxnet.Windows 7That said, it’s worth noting that the driver will not run on systems with Windows 7 or later.
Countries
Industries
EngineeringOne such block is capable of corrupting mathematical calculations, specifically going after tools used in civil engineering, physics, and physical process simulations.nuclearCybersecurity researchers have discovered a new Lua-based malware created years before the notorious Stuxnet worm that aimed to sabotage Iran’s nuclear program by destroying uranium enrichment centrifuges.Scientific researchbut systematic errors into physicalâworld calculations, the framework could undermine or slow scientific research programs, degrade engineered systems over time, or even contribute to catastrophic damage,”