Mastodawn

Decades-old pre-Stuxnet cyber sabotage tool breaks cover, #NSA listed it as 'nothing to see here' — #fast16 targeted nuclear reactors, dam design, and other high-precision #civilengineering software years before #Stuxnet
Sentinel Labs notes that the name ‘fast16’ can be found referenced in an infamous NSA ‘territorial dispute’ file leak. The line “fast16 *** Nothing to see here – carry on ***” singles out fast16 being one of - if not the - most important NSA hack tools.
https://www.tomshardware.com/software/security-software/decades-old-pre-stuxnet-cyber-sabotage-tool-breaks-cover-nsa-listed-it-as-nothing-to-see-here-fast16-targeted-nuclear-reactors-dam-design-and-other-high-precision-civil-engineering-software-years-before-stuxnet-broke-cover

Decades-old pre-Stuxnet cyber sabotage tool breaks cover, NSA listed it as 'nothing to see here' — fast16 targeted nuclear reactors, dam design, and other high-precision civil engineering software years before Stuxnet broke cover

Fast16 appears to be at least half a decade older than Stuxnet.

Tom's Hardware

CyberVeille.ch May 17

📢 Fast16 : le malware qui sabotait les simulations d'armes nucléaires iraniennes en 2005
📝 ## 🗓️ Contexte

Publié le 16 mai 2026 sur Zero Day (zetter-zeroday.com) par Ki...
📖 cyberveille : https://cyberveille.ch/posts/2026-05-17-fast16-le-malware-qui-sabotait-les-simulations-d-armes-nucleaires-iraniennes-en-2005/
🌐 source : https://www.zetter-zeroday.com/experts-confirm-the-fast16-malware-was-sabotaging-nuclear-weapons-tests-likely-in-iran/
#Fast16 #Olympic_Games #Cyberveille

Fast16 : le malware qui sabotait les simulations d'armes nucléaires iraniennes en 2005

🗓️ Contexte Publié le 16 mai 2026 sur Zero Day (zetter-zeroday.com) par Kim Zetter, cet article s’appuie sur une nouvelle analyse publiée simultanément par la Threat Hunter Team de Symantec et l’Institute for Science and International Security (ISIS), confirmant et approfondissant une découverte initiale de SentinelOne. 🦠 Le malware Fast16 Fast16 est un malware compilé le 30 août 2005, découvert en 2019 par Juan Andres Guerrero-Saade (SentinelOne) après avoir été mentionné dans des outils NSA divulgués par les Shadow Brokers en 2017. Un échantillon avait été uploadé sur VirusTotal en octobre 2017.

CyberVeille

Miguel Afonso Caetano May 17

"Researchers have confirmed that a remarkable piece of malware discovered years ago but analyzed only recently was designed to subvert nuclear weapons testing simulations with the aim of undermining those tests and slowing the progress of a nuclear program. The new information, from researchers at the security firm Symantec, confirms what has only previously been speculated about the code by the company that first discovered it — SentinelOne.

The malicious code, known as Fast16, was designed to subvert at least two specialized software programs that were commonly used for simulating weapons explosions at the time the code was active in 2005. It cleverly swapped out legitimate data produced by the simulation software, replacing it with false data that was fed to engineers monitoring those simulated tests. Specifically, it waited until the simulation neared the point of “supercriticality,” when the chain reaction leading to a nuclear explosion would begin, and altered data pertaining to the pressure inside the uranium core to indicate to engineers that the pressure was insufficient to achieve supercriticality, even though the real data showed otherwise.

This appears to have been aimed at tricking the engineers into believing the tests were less successful than they actually were, in order create confusion and slow the progress of the nuclear program Fast16 was targeting.

Nuclear experts say that based on details contained in the code and the period in which it was active, they are certain the target was Iran’s nuclear weapons program."

https://www.zetter-zeroday.com/experts-confirm-the-fast16-malware-was-sabotaging-nuclear-weapons-tests-likely-in-iran/

#CyberSecurity #StateHacking #Malware #Fast16 #Iran #NuclearWeapons

Experts Confirm the Fast16 Malware Was Sabotaging Nuclear Weapons Tests, Likely in Iran

Fast16 didn't predate Stuxnet but was contemporaneous with it. It also wasn't aimed at altering nuclear weapons but was simply feeding false data to engineers about the nuclear detonation tests they were conducting, in order to trick them into believing the tests were failing.

ZERO DAY

Tom's Hardware Italia Apr 29

🔐 Fast16 ritorna: il misterioso sabotaggio pre-Stuxnet che ci fa riflettere sulla sicurezza digitale. Come proteggere i nostri dati? #Cybersicurezza #Fast16

🔗 https://www.tomshw.it/hardware/fast16-sabotaggio-prima-di-stuxnet

Fast16 riemerge: il sabotaggio prima di Stuxnet

I ricercatori descrivono fast16, malware pre-Stuxnet capace di alterare calcoli tecnici in software per dighe e reattori.

Tom's Hardware

securityaffairs Apr 27

#Fast16: Pre-#Stuxnet #malware that targeted precision engineering software
https://securityaffairs.com/191325/malware/fast16-pre-stuxnet-malware-that-targeted-precision-engineering-software.html
#securityaffairs #hacking #China

Fast16: Pre-Stuxnet malware that targeted precision engineering software

Fast16 is a pre-Stuxnet malware that tampered with precision software and spread itself. Evidence suggests links to U.S. operations.

Security Affairs

Hacker News Apr 26

Fast16: The Cyberweapon That Predates Stuxnet by Five Years

https://hackingpassion.com/fast16-pre-stuxnet-cyber-sabotage/

#HackerNews #Fast16 #Cyberweapon #Stuxnet #Cybersecurity #Hacking #News

Fast16: The Cyberweapon That Predates Stuxnet by Five Years

For 21 years, fast16 corrupted nuclear research calculations without anyone noticing. It predates Stuxnet by five years. The math was always wrong.

HackingPassion.com : [email protected][~]

The New Oil Apr 25

Newly Deciphered #Sabotage #Malware May Have Targeted #Iran’s #Nuclear Program—and Predates #Stuxnet

https://www.wired.com/story/fast16-malware-stuxnet-precursor-iran-nuclear-attack/

#Fast16 #cybersecurity #politics

Newly Deciphered Sabotage Malware May Have Targeted Iran’s Nuclear Program—and Predates Stuxnet

Researchers have finally cracked Fast16, mysterious code capable of silently tampering with calculation and simulation software. It was created in 2005—and likely deployed by the US or an ally.

WIRED

CyberVeille.ch Apr 24

📢 Fast16 : un malware de sabotage antérieur à Stuxnet ciblant potentiellement le programme nucléaire iranien
📝 ## 🔍 Contexte

Publié le 23 avril 2026 par Andy Greenberg sur Wired, cet article rapp...
📖 cyberveille : https://cyberveille.ch/posts/2026-04-24-fast16-un-malware-de-sabotage-anterieur-a-stuxnet-ciblant-potentiellement-le-programme-nucleaire-iranien/
🌐 source : https://www.wired.com/story/fast16-malware-stuxnet-precursor-iran-nuclear-attack/
#Fast16 #IOC #Cyberveille

Fast16 : un malware de sabotage antérieur à Stuxnet ciblant potentiellement le programme nucléaire iranien

🔍 Contexte Publié le 23 avril 2026 par Andy Greenberg sur Wired, cet article rapporte la présentation des chercheurs Vitaly Kamluk et Juan Andrés Guerrero-Saade de SentinelOne à la conférence Black Hat Asia à Singapour. Ils y dévoilent leur analyse complète du malware Fast16, dont l’existence était connue depuis 2017 mais dont le fonctionnement réel était resté inexpliqué pendant 21 ans. 🧬 Découverte et historique 2005 : compilation du driver kernel Fast16.sys, date probable de création du malware 2017 : révélation de l’existence de Fast16 via la fuite des outils NSA par les Shadow Brokers, dans l’outil Territorial Dispute — avec la mention interne “NOTHING TO SEE HERE—CARRY ON” 2019 : Juan Andrés Guerrero-Saade retrouve un échantillon sur VirusTotal sous le nom svcmgmt.exe, contenant le driver Fast16.sys 2026 : Vitaly Kamluk procède au reverse engineering complet, révélant la véritable nature du malware ⚙️ Fonctionnement technique Fast16 n’est pas un rootkit comme supposé initialement (cinq outils IA de premier plan l’ont incorrectement classifié comme tel). Il s’agit d’un malware de sabotage à propagation automatique :

CyberVeille

G0rb

Apr 24

F*ck #fast16, I want #bsdnfs

fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet | SentinelOne
https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet/

fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet

A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.

SentinelOne

Miguel Afonso Caetano Apr 24

"In the history of state-sponsored hacking, the spectrum of cyber operations bent on sabotage have ranged from crude “wiper” attacks that destroy data on target computers to the legendary Stuxnet, a piece of malware the US and Israel first deployed in Iran in 2007 to silently accelerate the spinning of nuclear enrichment centrifuges until they destroyed themselves. Now researchers have discovered another chapter in that decades-long evolution of cybersabotage techniques: a 21-year-old specimen of malware capable of tampering with research and engineering software to undetectably sow mayhem—one that may have been used in Iran, even before Stuxnet.

Vitaly Kamluk and Juan Andrés Guerrero-Saade, two researchers from the cybersecurity firm SentinelOne, on Thursday revealed a breakthrough in the mystery of a piece of malware known as Fast16, a piece of code whose purpose has eluded the cybersecurity world since its existence was first revealed in an NSA leak in 2017. The SentinelOne researchers have now reverse-engineered the Fast16 code, which they say dates back to 2005 and was likely created by either the US government or one of its allies.

Kamluk and Guerrero-Saade have determined that the Fast16 malware was designed to carry out the most subtle form of sabotage ever seen in an in-the-wild malware tool: By automatically spreading across networks and then silently manipulating computation processes in certain software applications that perform high-precision mathematical calculations and simulate physical phenomena, Fast16 can alter the results of those programs to cause failures that range from faulty research results to catastrophic damage to real-world equipment."

https://www.wired.com/story/fast16-malware-stuxnet-precursor-iran-nuclear-attack/

#CyberSecurity #NSA #Fast16 #StateHacking #Iran #USA

Newly Deciphered Sabotage Malware May Have Targeted Iran’s Nuclear Program—and Predates Stuxnet

Researchers have finally cracked Fast16, mysterious code capable of silently tampering with calculation and simulation software. It was created in 2005—and likely deployed by the US or an ally.

WIRED