Researchers Detail Pre-Stuxnet Fast16 Malware Built for Strategic Sabotage
Summary
SentinelLabs analyzed Fast16, a Lua-based malware referenced in the ShadowBrokers leak and reportedly used in 2005. Its driver could patch precision-calculation software; researchers say evidence suggests US development, while specific targets remain unconfirmed.
Key points
- SentinelLabs identified svcmgmt.exe, a service binary with an embedded Lua 5.0 virtual machine, as Fast16’s core component.
- The fast16.sys driver could intercept filesystem I/O and modify executable files compiled with Intel’s C/C++ compiler by adding PE sections.
- Fast16 propagated across Windows 2000 and XP file shares using default or weak passwords, but reportedly avoided environments containing certain vendor keys.
- Researchers say the malware’s patching patterns suggest an aim to alter precision calculations for strategic sabotage, rather than generic espionage.
- LS-DYNA 970, PKPM, and MOHID were identified as potential targets, but SentinelLabs has not identified binaries targeted by the driver.
- SentinelLabs found evidence suggesting Fast16 may have been developed by the United States; the article presents this as an attribution assessment, not a confirmed finding.
Article Details
- Attack Vectors
- Fast16 used weak or default passwords for Windows file shares to propagate between systems on the same network.
- The malware's service binary could execute embedded Lua code and spawn commands based on command-line arguments.
- The fast16.sys kernel driver inserted itself above filesystems and routed filesystem I/O through its worker devices.
- The driver modified executable headers to patch calculation software, potentially altering its outputs.
MITRE ATT&CK
T1014 · RootkitThe fast16.sys kernel driver inserted itself above filesystems and intercepted filesystem I/O.T1027 · Obfuscated Files or InformationThe article describes encrypted, task-specific payloads carried by a reusable outer binary.T1059 · Command and Scripting Interpretersvcmgmt.exe contains a Lua virtual machine and can execute Lua code.T1570 · Lateral Tool TransferFast16 propagated to other systems on the same network through Windows file shares.
Malware
Products
LS-DYNA 970three high-precision engineering and simulation suites potentially targeted by Fast16, namely LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform, but has yet to identify binaries in the driver’sMOHIDengineering and simulation suites potentially targeted by Fast16, namely LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform, but has yet to identify binaries in the driver’s crosshairs.PKPMthree high-precision engineering and simulation suites potentially targeted by Fast16, namely LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform, but has yet to identify binaries in the driver’s crosshairs.Windows 2000For propagation, it used default or weak passwords for file shares on Windows 2000 and XP, moving between systems through standard APIs.
Countries
Industries
Civil engineeringwas designed to hijack or influence the execution flows of precision calculation tools used in civil engineering, physics, and physical process simulations.nuclearThere is evidence that LS-DYNA has been used by Iran as part of its nuclear weapons development program.Scientific researchbut systematic errors into physical‑world calculations, the framework could undermine or slow scientific research programs, degrade engineered systems over time, or even contribute to catastrophic damage,”