Fast16: Precision Software Sabotage Predating Stuxnet by 5 Years

SentinelLABS analyzed an undisclosed cyber sabotage framework called fast16, dating back to 2005. Its core components are fast16.sys and svcmgmt.exe, designed to manipulate the output of high-precision calculation software via memory patching, spreading the same errors across an entire facility.

svcmgmt.exe acts as a carrier with an embedded Lua 5.0 VM, separating configuration, propagation, and control logic through encrypted Lua bytecode and Windows API bindings. Its execution mode also branched into service execution, Lua execution, and protocol wrapping depending on command-line arguments, showing a modular structure.

fast16.sys is a filesystem driver loaded early at boot, operating by intercepting and modifying executable code as it was read from disk. This driver targeted Windows 2000/XP environments and included a wormlet that used network shares and service control APIs to replicate and distribute itself.

During analysis, the PDB path of svcmgmt.exe was linked to fast16.sys, and the same string "fast16" was also found in the NSA Territorial Dispute-related list from the 2017 ShadowBrokers leak. Based on this, the author concluded that fast16 is precision sabotage that predates Stuxnet by at least 5 years, and the earliest known instance of such a case.

• A pre-installation check examined security product registry keys and could halt deployment
• It propagated using default shares and weak administrator passwords
• It provided a minimal reporting channel via ConnotifyDLL upon RAS network connection