SentinelLABS Links ShadowBrokers’ fast16 Reference to a 2005 Precision-Sabotage Framework
Summary
SentinelLABS analyzed fast16, a 2005 Lua-based framework whose boot-start driver patched executable code in memory, apparently targeting high-precision engineering software. Researchers linked its name to ShadowBrokers’ Territorial Dispute signatures; exact targets are未
Key points
- SentinelLABS identified fast16 components including the Lua 5.0 carrier svcmgmt.exe and boot-start filesystem driver fast16.sys.
- The driver used 101 rules to patch executable code in memory as files were read, including a floating-point routine intended to alter precision calculations.
- Targeting logic selected .EXE files with an Intel compiler artifact; pattern matches pointed to LS-DYNA 970, PKPM and MOHID as candidates, but researchers could not definitively identify all intended targets.
- An SCM wormlet could spread the carrier through network shares and remote Windows services, relying on weak or default administrative passwords.
- Before propagation, the carrier checked for security-product registry keys and could abort installation in monitored environments.
- A PDB path linked the carrier to fast16.sys, whose name also appeared in ShadowBrokers’ Territorial Dispute signatures.
- The researchers provide YARA rules and indicators to help identify the carrier, driver and patch patterns.
Article Details
- Attack Vectors
- The SCM wormlet copies the carrier over network shares and starts a remote Windows service, relying on weak or default administrative passwords.
- The carrier installs as the SvcMgmt Windows service and can deploy the boot-start fast16.sys driver.
- fast16.sys patches matching .EXE files in memory as they are read. Its selection rule requires a printable ASCII string beginning with “Intel” after the last PE section header; pattern matches suggested LS-DYNA 970, PKPM, and MOHID as possible targets, but the article says the intended targets are not definitively identified.
- Defensive Notes
- The article provides YARA rules for hunting the carrier, driver, and patch signatures.
- Use the driver’s Devicefast16 and ??fast16 device names and the .pipep577 named pipe as forensic markers.
- The article reports that fast16.sys sets the Windows Prefetcher EnablePrefetcher value to 0 and that the carrier checks security-product registry keys before installation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 0ff6abe0252d4f37a196a1231fae5f26 | MD5 hash identified for the fast16.sys sabotage driver. |
| MD5 | 410eddfc19de44249897986ecc8ac449 | MD5 hash identified for the fast16 reporting DLL. |
| MD5 | dbe51eabebf9d4ef9581ef99844a2944 | MD5 hash identified for the svcmgmt.exe carrier. |
| SHA1 | 675cb83cec5f25ebbe8d9f90dea3d836fcb1c234 | SHA-1 hash listed for the connotify.dll reporting component. |
| SHA1 | 92e9dcaf7249110047ef121b7586c81d4b8cb4e5 | SHA-1 hash listed for the fast16.sys driver. |
| SHA1 | de584703c78a60a56028f9834086facd1401b355 | SHA-1 hash identified for the svcmgmt.exe carrier. |
| SHA256 | 07c69fc33271cf5a2ce03ac1fed7a3b16357aec093c5bf9ef61fbfa4348d0529 | SHA-256 hash identified for the fast16.sys sabotage driver. |
| SHA256 | 9a10e1faa86a5d39417cae44da5adf38824dfb9a16432e34df766aa1dc9e3525 | SHA-256 hash identified for the svcmgmt.exe carrier. |
MITRE ATT&CK
T1012 · Query RegistryThe carrier queries registry keys associated with security products and aborts installation if they are present.T1021.002 · SMB/Windows Admin SharesThe SCM wormlet copies the payload over network shares and starts a service on the remote system.T1055 · Process InjectionThe driver modifies executable code in memory as files are read, including adding sections and applying a routine that alters floating-point calculations.T1064 · Scriptingsvcmgmt.exe embeds a Lua 5.0 VM that unpacks and executes encrypted Lua bytecode for framework logic.T1543.003 · Windows ServiceThe carrier installs and starts itself as the SvcMgmt Windows service.T1547 · Boot or Logon Autostart Executionfast16.sys is configured as a boot-start filesystem driver and loads early in the boot process.T1562.001 · Disable or Modify ToolsThe driver disables Windows Prefetcher, and the carrier checks for security-product registry keys before proceeding with installation.
People
Boldizsár BencsáthHis research into Territorial Dispute pointed to drv_list.txt, which contained the fast16 reference discussed in the investigation.Costin RaiuAcknowledged by SentinelLABS for contributions to the fast16 research.Sergey MineevThe article says he pioneered techniques that enabled the fast16 discovery.Silas CutlerAcknowledged by SentinelLABS for contributions to the fast16 research.
Malware
Products
LS-DYNA 970strongest overlaps point to three high-precision engineering and simulation suites from the mid-2000s: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform, all used for scenarios like crash testing,MOHIDStrong candidate targets identified by pattern matching include LSâDYNA 970, PKPM, and MOHID—specialized engineering and simulation suites used for crash testing, structural analysis, and hydrodynamic modeling.PKPMto deploy the driver across a facility, targeted engineering and simulation suites such as LSâDYNA and PKPM, and later appeared in the ShadowBrokers “Territorial Dispute” signatures.Windows 2000/XPOn the surface, svcmgmt.exe appears to be a generic consoleâmode service wrapper from the Windows 2000/XP era.
Tools
Industries
aerospace engineeringIt was commonly used by automotive companies, aerospace engineering, defense and military research, as well as manufacturing and materials science applications.Civil engineeringThey were precision calculation tools in specialised domains such as civil engineering, physics and physical process simulations.defense and military researchIt was commonly used by automotive companies, aerospace engineering, defense and military research, as well as manufacturing and materials science applications.environmental modelingmodeling platform, all used for scenarios like crash testing, structural analysis, and environmental modeling.ManufacturingLS-DYNA is designed for handling dynamic, complex events that occur at speed, such as car crashes, explosions, impacts, metal forming, and manufacturing processes.materials scienceIt was commonly used by automotive companies, aerospace engineering, defense and military research, as well as manufacturing and materials science applications.physicsThis 2005 attack is a harbinger for sabotage operations targeting ultra expensive high-precision computing workloads of national importance like advanced physics, cryptographic, and nuclear research workloads.