SentinelOne uncovers 2005 fast16 malware predating Stuxnet

Cybersecurity researchers at SentinelOne have uncovered a previously unknown malware framework called fast16, dating to 2005, that represents the earliest known example of a cyber tool designed to sabotage high-precision engineering and scientific calculations.

The framework, analyzed by SentinelOne researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade, predates the 2010 discovery of Stuxnet, long considered the first cyber weapon aimed at physical disruption. Fast16 introduces subtle, systematic errors into floating-point computations within targeted software, potentially degrading engineering projects or causing long-term failures without immediate detection. Infected systems produce consistent erroneous results, which could undermine nuclear reactor modeling, dam designs, structural analyses, and physics simulations if multiple machines are compromised.

Researchers traced fast16 through svcmgmt.exe, a seemingly benign file uploaded to VirusTotal around a decade ago that evaded most detection engines. This carrier deploys wormlets via Windows service control and file-sharing APIs, exploiting weak admin passwords on network shares in Windows 2000 and XP environments. It...