Fast16 Malware: The first cyber sabotage tool before Stuxnet

A new technical analysis from the security teams at Symantec and Carbon Black sheds light on one of the most disturbing chapters in the history of cyberwarfare. The “ fast16 ” malware, a previously unknown industrial sabotage framework based on the Lua language , appears to have been specifically designed to tamper with nuclear weapons simulations as early as the mid-2000s — several years before the infamous Stuxnet became known worldwide.

According to the new findings, fast16 was not an ordinary spyware or sabotage. Its main goal was to affect critical uranium compression simulations used in the design and evaluation of nuclear systems.

The revelation is considered extremely important, as it changes the picture that existed until now about when the era of cyberattacks against physical and strategic infrastructure began.

A malware designed for nuclear sabotage

Researchers from Symantec and Carbon Black confirm that fast16 was specifically developed to interfere with highly specialized high-explosive scientific simulations.

See also: ZiChatBot Malware: Malicious PyPI Packages Target Windows and Linux

The malware targets two advanced mechanical simulation programs, LS-DYNA and AUTODYN, which are widely used for explosion analysis, material behavior, collision modeling, and military applications.

According to technical analysis, fast16 selectively monitored specific simulations involving high-density materials. The malware only triggered its intervention mechanisms when the density exceeded 30 g/cm³ — a level associated with uranium under extreme compression in nuclear explosions.

This means that the malware did not operate randomly or in general, but was designed with a thorough understanding of the physics and processes used in nuclear weapons research.

The “missing piece” before Stuxnet

The existence of fast16 was first brought to light a few weeks ago through research by SentinelOne, which described it as the first known industrial cyber-sabotage framework.

The most striking element is that some components of the malware appear to have been created as early as 2005 — about two years before the earliest known version of Stuxnet.

For years, Stuxnet was considered the first sophisticated cyberweapon designed to physically destroy industrial facilities, following the attack on uranium enrichment centrifuges at Iran's Natanz facility. However, new evidence suggests that state cyber sabotage programs were already underway much earlier.

SentinelOne had spotted a reference to the name “fast16” in files leaked in 2017 by the Shadow Brokers. These files are allegedly linked to the Equation Group, a state-backed group that has long been believed to have ties to the NSA.

101 sabotage rules and continuous evolution

At the heart of fast16 is a complex “hooking” mechanism that includes 101 different rules for interfering with mathematical calculations.

These rules targeted different versions of LS-DYNA and AUTODYN, which indicates that the malware authors closely monitored software upgrades and constantly updated their framework.

See also: Malware exploits Microsoft Phone Link to steal SMS OTPs

Researchers identified up to 10 different hook groups, which appear to have been added gradually over the years. This suggests a long-standing and organized operation, likely with state support and significant financial resources.

Even more worrying is the fact that the malware was designed to alter the results of the simulations without immediately arousing suspicion among the scientists using the systems.

In practice, a researcher could believe that his calculations were correct, when in fact the results had been deliberately falsified.

Stealth capabilities and spread within the network

Fast16 also had advanced stealth for its time. According to analysis, the malware avoided infecting computers that had certain security products installed, indicating a high level of knowledge around antivirus and endpoint detection technologies.

At the same time, it automatically propagated to other endpoints within the same network, ensuring that all systems participating in the simulations would produce the same corrupted outputs.

This strategy was critical, as it prevented the detection of discrepancies between different workstations or clusters.

The new era of cyberwarfare had begun earlier than we thought

Experts estimate that fast16 is one of the most advanced examples of early-stage cyber sabotage identified to date.

Vikram Thakur described the level of technical and scientific expertise required to develop such malware as early as 2005 as "astonishing."

See also: Cyber ​​attacks on energy networks: Can a country fall without war?

The framework was not designed simply to infect computers, but to understand specific physical processes and intervene in highly specialized scientific models.

Researchers emphasize that fast16 belongs to the same “genealogy” as Stuxnet: malware designed not just for a software or a manufacturer, but for the very physical process that controls the software.

This revelation shows that state-level cyberwarfare had already evolved into a much more dangerous and mature form long before the global cybersecurity community.