Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software

SentinelOne researchers discovered fast16, a previously undocumented Lua‑powered Windows sabotage framework dating to 2005 that predates Stuxnet. fast16 comprises a flexible carrier (svcmgmt.exe), an auxiliary ConnotifyDLL (svcmgmt.dll), and a kernel driver (fast16.sys) that intercepts and patches executables—targeting high‑precision engineering and simulation software (e.g., LS‑DYNA, PKPM, MOHID) to introduce subtle calculation errors. The tool includes propagation logic for legacy Windows (2000/XP), environment checks for security products, and forensic links to a 2017 leak of Equation Group artifacts, suggesting a state‑level, long‑running capability for covert cyber‑physical sabotage.