Cybersecurity researchers have found a brand new Lua-based malware created years earlier than the infamous Stuxnet worm that aimed to sabotage Iran’s nuclear program by destroying uranium enrichment centrifuges.
In line with a brand new report revealed by SentinelOne, the beforehand undocumented cyber sabotage framework dates again to 2005, primarily concentrating on high-precision calculation software program to tamper with outcomes. It has been codenamed fast16.
“By combining this payload with self-propagation mechanisms, the attackers purpose to supply equal inaccurate calculations throughout a whole facility,” researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade mentioned in an exhaustive report revealed this week.
Fast16 is assessed to predate Stuxnet, the primary identified digital weapon engineered for disruptive actions, and which served as the idea for the Duqu info stealer rootkit, by at the very least 5 years. Stuxnet is broadly believed to have been developed by the U.S. and Israel.
It additionally precedes the earliest identified samples of Flame (aka Flamer and Skywiper), one other subtle malware that was found in 2012, incorporating a Lua digital machine to understand its objectives. The invention makes fast16 the primary pressure of Home windows malware to embed a Lua engine.
SentinelOne mentioned it made the invention after it recognized an artifact named “svcmgmt.exe” that, at first blush, gave the impression to be a generic console‑mode service wrapper. The pattern has a file creation timestamp of August 30, 2005, per VirusTotal, to which it was uploaded greater than a decade in a while October 8, 2016.
Nonetheless, a deeper investigation has revealed an embedded Lua 5.0 digital machine and an encrypted bytecode container, together with numerous different modules that bind straight into Home windows NT file system, registry, service management, and community APIs.
The implant’s core logic resides within the Lua bytecode, with the binary additionally referencing a kernel driver (“fast16.sys“) by way of a PDB path – a file with a creation date of July 19, 2005 – that is accountable for intercepting and modifying executable code because it’s learn from disk. That mentioned, it is value noting that the driving force is not going to run on techniques with Home windows 7 or later.
In what’s a discovering that might give a sign of the software’s origins, SentinelOne mentioned it uncovered a reference to the string “fast16” in a textual content file referred to as “drv_list.txt” that included a listing of drivers designed to be used in superior persistent risk (APT) assaults. The almost 250KB file was leaked by a mysterious hacking group 9 years in the past.
In 2016 and 2017, the collective – calling itself The Shadow Brokers – revealed huge troves of information allegedly stolen from the Equation Group, a complicated persistent risk group with suspected ties to the U.S. Nationwide Safety Company (NSA). This included a bevy of hacking instruments and exploits underneath the nickname “Misplaced in Translation.” The textual content file was considered one of them.
“The string inside svcmgmt.exe supplied the important thing forensic hyperlink on this investigation,” SentinelOne mentioned. “The PDB path connects the 2017 leak of deconfliction signatures utilized by NSA operators with a multi-modal Lua‑powered ‘provider’ module compiled in 2005, and in the end its stealthy payload: a kernel driver designed for precision sabotage.”
“Svcmgmt.exe” has been described as a “extremely adaptable provider module” that may alter its habits based mostly on the command-line arguments handed to it, enabling it to run as a Home windows service or execute Lua code. It comes with three distinct payloads: Lua bytecode to deal with configuration and propagation and coordination logic, an auxiliary ConnotifyDLL (“svcmgmt.dll“), and the “fast16.sys” kernel driver.
Particularly, it is designed to parse the configuration, escalate itself as a service, optionally deploy the kernel implant, and launch a Service Management Supervisor (SCM) wormlet that scans for community servers and propagates the malware to different Home windows 2000/XP environments with weak or default credentials.
An necessary facet value mentioning right here is that the propagation solely happens when it is manually compelled, or frequent safety merchandise aren’t discovered on the system by scanning the Home windows Registry database for related registry keys. Among the safety instruments it explicitly checks belong to Agnitum, F-Safe, Kaspersky, McAfee, Microsoft, Symantec, Sygate Applied sciences, and Development Micro.
The presence of Sygate Applied sciences is one other indicator that the pattern was developed within the mid-2000s, as the corporate was acquired by Symantec, now a part of Broadcom, in August 2025, and gross sales and help for its merchandise have been formally discontinued by November.
“For tooling of this age, that stage of environmental consciousness is notable,” SentinelOne mentioned. “Whereas the listing of merchandise could not appear complete, it probably displays the merchandise the operators anticipated to be current of their goal networks whose detection know-how would threaten the stealthiness of a covert operation.”
The ConnotifyDLL, however, is invoked every time the system establishes a brand new community connection utilizing the Distant Entry Service (RAS), and writes the distant and native connection names to a named pipe (“.pipep577”).
Nonetheless, it is the driving force that is accountable for the precision sabotage, concentrating on executables compiled with the Intel C/C++ compiler to carry out rule-based patching and hijack execution circulate by malicious code injections. One such block is able to corrupting mathematical calculations, particularly going after instruments utilized in civil engineering, physics, and bodily course of simulations.
“By introducing small however systematic errors into bodily‑world calculations, the framework might undermine or gradual scientific analysis packages, degrade engineered techniques over time, and even contribute to catastrophic harm,” SentinelOne defined.
“By separating a comparatively secure execution wrapper from encrypted, task-specific payloads, the builders created a reusable, compartmentalized framework that they might adapt to totally different goal environments and operational targets whereas leaving the outer provider binary largely unchanged throughout campaigns.”
Primarily based on an evaluation of the 101 guidelines outlined within the patching engine and matching them towards software program used within the mid-2000s, it is assessed that three high-precision engineering and simulation suites could have been the targets: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform.
LS-DYNA, now a part of the Ansys Suite, is a general-purpose multi physics simulation software program bundle that is used for simulating crashes, impacts, and explosions. In September 2024, the Institute for Science and Worldwide Safety (ISIS) launched a report detailing Iran’s probably use of laptop modeling software program like LS-DYNA associated to nuclear weapons growth based mostly on an examination of 157 tutorial publications present in open-source scientific and engineering literature.
This chain of proof assumes significance contemplating Iran’s nuclear program is claimed to have suffered substantial harm after its uranium enrichment facility in Natanz was focused by the Stuxnet worm in June 2010. What’s extra, Symantec revealed in February 2013 an earlier model of Scholar that was used to assault Iran’s nuclear program in November 2007, with proof indicating it was underneath growth as early as November 2005.
“Stuxnet 0.5 is the oldest identified Stuxnet model to be analyzed,” Symantec famous on the time. “Stuxnet 0.5 accommodates an alternate assault technique, closing valves throughout the uranium enrichment facility at Natanz, Iran, which might have prompted critical harm to the centrifuges and uranium enrichment system as a complete.”
Taken collectively, the newest discovering “forces a re‑analysis” of the historic timeline of growth for clandestine cyber sabotage operations, SentinelOne mentioned, including it reveals state-backed cyber sabotage tooling towards bodily targets had been absolutely developed and deployed by the mid‑2000s.
“Within the broader image of APT evolution, fast16 bridges the hole between early, largely invisible growth packages and later, extra broadly documented Lua‑ and LuaJIT‑based mostly toolkits,” the researchers concluded. “It’s a reference level for understanding how superior actors take into consideration lengthy‑time period implants, sabotage, and a state’s capacity to reshape the bodily world by software program. fast16 was the silent harbinger of a brand new type of statecraft, profitable in its covertness till at this time.”
