🆒🆒🆒🆒🔢🔢
FAST16 — Pre-Stuxnet Sabotage Malware (2005)

- Referenced in Shadow Brokers (2017) leak (“NOTHING TO SEE HERE”)
- Compiled ~2005 → ~5 years before Stuxnet
- Type: Sabotage malware (not espionage)

Target

- High-precision engineering / simulation software
- Includes LS-DYNA, PKPM, MOHID
- Used for physics, impact, and advanced simulations (incl. nuclear-related domains)

Technique

- Kernel driver: "fast16.sys"
- In-memory patching of target processes
- Injects subtle calculation errors (floating-point manipulation)
- Goal: corrupt outputs while appearing normal

Propagation

- Worm-like spread via weak Windows network shares

Attribution

- Not confirmed
- Strong suspicion: US or allied origin (based on NSA-linked leak context)

Note

- LS-DYNA ≠ purely “explosive software”
- Broader simulation usage; “explosive calculations” is a subset use case