Fast16 Pre‑Stuxnet Sabotage Malware Alters Precision Engineering Calculations (2005)
What Happened – SentinelOne uncovered “Fast16,” a Lua‑based sabotage malware first seen in 2005 that infected Windows systems, loaded a kernel driver (fast16.sys), and subtly corrupted the results of high‑precision engineering software. The payload spread via network shares, evaded security tools, and injected floating‑point errors into calculations used by scientific and industrial programs.
Why It Matters for TPRM –
- Demonstrates that legacy, state‑sponsored malware can still reside in supply‑chain assets and be re‑activated.
- Highlights a non‑traditional sabotage vector that targets the integrity of engineering data rather than data exfiltration.
- Shows the need for deep code‑integrity verification and runtime integrity monitoring of critical design tools supplied by third‑party vendors.
Who Is Affected – Manufacturing & industrial control firms, aerospace & defense engineering groups, energy‑utility design teams, and any organization that relies on precision calculation software (e.g., CAD/CAE, simulation packages).
Recommended Actions –
- Review contracts with vendors of precision‑engineering tools for security‑by‑design clauses.
- Deploy integrity‑checking solutions (hash verification, code‑signing enforcement) on all engineering workstations.
- Conduct a forensic sweep for Fast16 artifacts (svcmgmt.exe, fast16.sys) on legacy Windows assets.
- Update endpoint detection and response (EDR) policies to flag Lua‑based loaders and unsigned kernel drivers.
Technical Notes – Fast16 uses an embedded Lua virtual machine to load encrypted “wormlets” that propagate via SMB shares. The fast16.sys driver hooks filesystem calls and manipulates floating‑point unit (FPU) instructions, producing deterministic but incorrect calculation outputs. The malware was found in the ShadowBrokers leak of NSA tools, suggesting a U.S. origin linked to early cyber‑warfare against Iran. No public CVE; the technique is a custom kernel‑level sabotage exploit. Source: SecurityAffairs