Cybersecurity researchers have found a brand new Lua-based malware created years earlier than the infamous Stuxnet worm that aimed to sabotage Iran’s nuclear program by destroying uranium enrichment centrifuges.
Based on a brand new report printed by SentinelOne, the beforehand undocumented cyber sabotage framework dates again to 2005, primarily focusing on high-precision calculation software program to tamper with outcomes. It has been codenamed fast16.
“By combining this payload with self-propagation mechanisms, the attackers aim to produce equivalent inaccurate calculations across an entire facility,” researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade stated in an exhaustive report printed this week.
Fast16 is assessed to predate Stuxnet, the primary identified digital weapon engineered for disruptive actions, and which served as the idea for the Duqu info stealer rootkit, by no less than 5 years. Stuxnet is extensively believed to have been developed by the U.S. and Israel.
It additionally precedes the earliest identified samples of Flame (aka Flamer and Skywiper), one other subtle malware that was found in 2012, incorporating a Lua digital machine to understand its targets. The invention makes fast16 the primary pressure of Home windows malware to embed a Lua engine.
SentinelOne stated it made the invention after it recognized an artifact named “svcmgmt.exe” that, at first blush, seemed to be a generic console‑mode service wrapper. The pattern has a file creation timestamp of August 30, 2005, per VirusTotal, to which it was uploaded greater than a decade in a while October 8, 2016.
Nonetheless, a deeper investigation has revealed an embedded Lua 5.0 digital machine and an encrypted bytecode container, together with varied different modules that bind instantly into Home windows NT file system, registry, service management, and community APIs.
The implant’s core logic resides within the Lua bytecode, with the binary additionally referencing a kernel driver (“fast16.sys”) through a PDB path – a file with a creation date of July 19, 2005 – that is chargeable for intercepting and modifying executable code because it’s learn from disk. That stated, it is value noting that the motive force won’t run on techniques with Home windows 7 or later.
In what’s a discovering that would give a sign of the instrument’s origins, SentinelOne stated it uncovered a reference to the string “fast16” in a textual content file referred to as “drv_list.txt” that included an inventory of drivers designed to be used in superior persistent risk (APT) assaults. The almost 250KB file was leaked by a mysterious hacking group 9 years in the past.
In 2016 and 2017, the collective – calling itself The Shadow Brokers – printed huge troves of knowledge allegedly stolen from the Equation Group, a sophisticated persistent risk group with suspected ties to the U.S. Nationwide Safety Company (NSA). This included a bevy of hacking instruments and exploits below the nickname “Lost in Translation.” The textual content file was one in every of them.
“The string inside svcmgmt.exe provided the key forensic link in this investigation,” SentinelOne stated. “The PDB path connects the 2017 leak of deconfliction signatures used by NSA operators with a multi-modal Lua‑powered ‘carrier’ module compiled in 2005, and ultimately its stealthy payload: a kernel driver designed for precision sabotage.”
“Svcmgmt.exe” has been described as a “highly adaptable carrier module” that may alter its habits based mostly on the command-line arguments handed to it, enabling it to run as a Home windows service or execute Lua code. It comes with three distinct payloads: Lua bytecode to deal with configuration and propagation and coordination logic, an auxiliary ConnotifyDLL (“svcmgmt.dll”), and the “fast16.sys” kernel driver.
Particularly, it is designed to parse the configuration, escalate itself as a service, optionally deploy the kernel implant, and launch a Service Management Supervisor (SCM) wormlet that scans for community servers and propagates the malware to different Home windows 2000/XP environments with weak or default credentials.
An necessary facet value mentioning right here is that the propagation solely happens when it is manually compelled, or widespread safety merchandise aren’t discovered on the system by scanning the Home windows Registry database for related registry keys. A few of the safety instruments it explicitly checks belong to Agnitum, F-Safe, Kaspersky, McAfee, Microsoft, Symantec, Sygate Applied sciences, and Development Micro.
The presence of Sygate Applied sciences is one other indicator that the pattern was developed within the mid-2000s, as the corporate was acquired by Symantec, now a part of Broadcom, in August 2025, and gross sales and assist for its merchandise had been formally discontinued by November.
“For tooling of this age, that level of environmental awareness is notable,” SentinelOne stated. “While the list of products may not seem comprehensive, it likely reflects the products the operators expected to be present in their target networks whose detection technology would threaten the stealthiness of a covert operation.”
The ConnotifyDLL, alternatively, is invoked every time the system establishes a brand new community connection utilizing the Distant Entry Service (RAS), and writes the distant and native connection names to a named pipe (“.pipep577”).
Nonetheless, it is the motive force that is chargeable for the precision sabotage, focusing on executables compiled with the Intel C/C++ compiler to carry out rule-based patching and hijack execution movement by way of malicious code injections. One such block is able to corrupting mathematical calculations, particularly going after instruments utilized in civil engineering, physics, and bodily course of simulations.
“By introducing small but systematic errors into physical‑world calculations, the framework could undermine or slow scientific research programs, degrade engineered systems over time, or even contribute to catastrophic damage,” SentinelOne defined.
“By separating a relatively stable execution wrapper from encrypted, task-specific payloads, the developers created a reusable, compartmentalized framework that they could adapt to different target environments and operational objectives while leaving the outer carrier binary largely unchanged across campaigns.”
Primarily based on an evaluation of the 101 guidelines outlined within the patching engine and matching them in opposition to software program used within the mid-2000s, it is assessed that three high-precision engineering and simulation suites might have been the targets: LS-DYNA 970, PKPM, and the MOHID hydrodynamic modeling platform.
LS-DYNA, now a part of the Ansys Suite, is a general-purpose multi physics simulation software program package deal that is used for simulating crashes, impacts, and explosions. In September 2024, the Institute for Science and Worldwide Safety (ISIS) launched a report detailing Iran’s probably use of pc modeling software program like LS-DYNA associated to nuclear weapons improvement based mostly on an examination of 157 educational publications present in open-source scientific and engineering literature.
This chain of proof assumes significance contemplating Iran’s nuclear program is claimed to have suffered substantial harm after its uranium enrichment facility in Natanz was focused by the Stuxnet worm in June 2010. What’s extra, Symantec revealed in February 2013 an earlier model of Scholar that was used to assault Iran’s nuclear program in November 2007, with proof indicating it was below improvement as early as November 2005.
“Stuxnet 0.5 is the oldest known Stuxnet version to be analyzed,” Symantec famous on the time. “Stuxnet 0.5 contains an alternative attack strategy, closing valves within the uranium enrichment facility at Natanz, Iran, which would have caused serious damage to the centrifuges and uranium enrichment system as a whole.”
Taken collectively, the most recent discovering “forces a re‑evaluation” of the historic timeline of improvement for clandestine cyber sabotage operations, SentinelOne stated, including it reveals state-backed cyber sabotage tooling in opposition to bodily targets had been totally developed and deployed by the mid‑2000s.
“In the broader picture of APT evolution, fast16 bridges the gap between early, largely invisible development programs and later, more widely documented Lua‑ and LuaJIT‑based toolkits,” the researchers concluded. “It is a reference point for understanding how advanced actors think about long‑term implants, sabotage, and a state’s ability to reshape the physical world through software. fast16 was the silent harbinger of a new form of statecraft, successful in its covertness until today.”
