Loading malware…
fast16 is a highly specialized Windows sabotage framework whose oldest known components date to around 2005, making it an early example of precision cyber sabotage that predates Stuxnet. Rather than directly manipulating industrial controllers or machinery, it is designed to spread within Windows networks and silently corrupt the outputs of selected high-precision engineering and physics simulation software. Public analysis has linked its targeting most strongly to LS-DYNA and AUTODYN, with earlier candidate overlap also noted for PKPM and MOHID. The malware’s behavior and trigger conditions indicate an intent to tamper with simulations involving high explosives and uranium-compression physics relevant to nuclear weapons research.
The framework consists of a service component, an embedded Lua-based operational layer, and a boot-start filesystem driver with a rule-driven patching engine. The driver intercepts executable code as targeted applications are loaded, identifies narrowly defined Intel-compiled binaries, and rewrites specific instruction sequences on the fly using a large set of byte-pattern rules grouped across multiple software builds. Its sabotage logic activates only under tightly constrained simulation conditions, including particular equation-of-state selections and density thresholds associated with implosion-style compression, then scales down selected pressure- or stress-related outputs so results remain plausible while becoming scientifically misleading. This selective corruption suggests deep knowledge of both the target software internals and the modeled physical processes.
fast16 also includes worm-like propagation inside local Windows environments. It can enumerate network resources, copy itself through administrative shares, impersonate the logged-on user, and create remote services to install on additional hosts, while restricting spread to local network ranges. It checks for the presence of certain security products before propagating or installing, reflecting deliberate stealth and operational restraint. Persistence has been associated with service-based execution, a boot-start driver, and Image File Execution Options abuse.
Researchers have assessed fast16 as a state-grade sabotage platform and have compared it conceptually to Stuxnet because both aim to undermine trusted technical processes through subtle, domain-specific manipulation rather than overt destruction. Multiple analyses have suggested likely relevance to Iranian nuclear-weapons-related modeling workflows, but definitive public attribution to a specific state or threat actor remains unconfirmed.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Security researchers have uncovered fast16, a highly specialized sabotage framework whose oldest software components appear to date back to roughly 2005—pre-dating Stuxnet’s deployment by nearly two years.
Security researchers have uncovered a cyber-sabotage platform that predates Stuxnet by at least half a decade... Fast16 was designed to corrupt floating-point calculations in a subtle, predictable, reproducible way.
Researchers have uncovered a malware framework dubbed "fast16" that predates Stuxnet by 5 years... Fast16's function was to quietly corrupt mathematical outputs of engineering and scientific software by introducing tiny systematic errors... SentinelOne described it as the first-ever Lua-based network worm targeting high-precision calculation software.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
On the surface, svcmgmt.exe appears to be a Windows service implant with two embedded components.
For persistence, fast16 abuses Image File Execution Options by writing its own path into the Debugger value under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>, which causes Windows to launch fast16 instead of the chosen application.
That kernel driver then reads the code of applications as they're loaded into the computer's memory, monitoring for a long list of specific patterns—“rules” that allow it to identify when a target application is running. When it detects the target software, it carries out its apparent goal: silently altering the calculations the software is running to imperceptibly corrupt its results.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
Fast16 propagates within a target network using share enumeration and impersonation... fast16 impersonates the locally logged-on user's credentials
On the surface, svcmgmt.exe appears to be a Windows service implant with two embedded components.
For persistence, fast16 abuses Image File Execution Options by writing its own path into the Debugger value under HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<target>, which causes Windows to launch fast16 instead of the chosen application.
A kernel driver easily mistaken for a filesystem rootkit actually contains a patching engine with 101 rules...
Under the install flags, fast16 copies itself to %windir%\system32\svcmgmt.exe, timestamps the file by cloning creation dates and ACL permissions from services.exe... It then drops the fast16.sys kernel driver into the system drivers folder, matches its timestamps to beep.sys
That kernel driver then reads the code of applications as they're loaded into the computer's memory, monitoring for a long list of specific patterns—“rules” that allow it to identify when a target application is running. When it detects the target software, it carries out its apparent goal: silently altering the calculations the software is running to imperceptibly corrupt its results.
On execution, the malware deletes that registry key, launches the original application, re-adds the key to maintain persistence...
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe
Fast16 propagates within a target network using share enumeration and impersonation... fast16 impersonates the locally logged-on user's credentials
On execution, the malware deletes that registry key, launches the original application, re-adds the key to maintain persistence, and then re-runs itself with the 'r' command-line argument for normal execution. The user sees a working application while the hijack is silently restored.
The core sabotage logic only activated under narrow conditions. Fast16 first verified that a supported simulator was running and that a scenario matched high‑explosive implosion tests consistent with a spherical uranium core design.
The driver waits silently until EXPLORER.EXE initializes... The hooks for Mechanism B specifically targeted LS-DYNA runs. The malware scanned volatile memory to see if the user selected specific mathematical models designed for modeling high-explosive behavior.
The driver waits silently until EXPLORER.EXE initializes and then maps out files compiled with the Intel Fortran or C++ compilers.
In parallel, fast16 enumerates all domains, servers, and shares to discover further remote hosts.
For machines that qualify, fast16 impersonates the locally logged-on user's credentials, copies itself to \\<remote>\admin$\system32\svcmgmt.exe, and creates a remote SvcMgmt service to start execution on the new host.
We recently published our research on fast16, a 2005 Windows toolkit built to sabotage high-precision solvers used to model nuclear-weapons behavior.
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A 2005 sabotage implant referenced as a benign reverse-engineering benchmark target in testing of agentic models.
A sabotage implant from 2005 used here as a benign reverse-engineering benchmark target.
A sabotage framework that propagates through Windows networks and covertly corrupts engineering simulation outputs, with highly selective trigger conditions tied to nuclear-weapons-related simulations.
Windows sabotage implant from 2005 designed to tamper with high-precision solvers used in nuclear weapons modeling. The article describes a layered architecture including a Windows service (svcmgmt.exe), an encrypted Lua-driven operational framework, and a kernel driver with a patching engine containing 101 rules.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.