--- title: fast16 | Mystery ShadowBrokers Reference Reveals... description: SentinelLABS has uncovered 'fast16', a previously undocumented cyber sabotage framework dating to 2005 — predating Stuxnet by five years. The framework... canonical: https://daily.dev/posts/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stu-lwjq7xgor twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet | daily.dev og:description: SentinelLABS has uncovered 'fast16', a previously undocumented cyber sabotage framework dating to 2005 — predating Stuxnet by five years. The framework... og:url: https://daily.dev/posts/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stu-lwjq7xgor og:image: https://api.daily.dev/og/posts/LWJq7xGOr.png og:image:alt: fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet **[Hacker News](https://daily.dev/sources/hn)** · 34 min read · 1 upvotes · 0 comments ## Summary SentinelLABS has uncovered 'fast16', a previously undocumented cyber sabotage framework dating to 2005 — predating Stuxnet by five years. The framework consists of a Lua-powered wormable carrier (svcmgmt.exe) and a kernel-mode filesystem driver (fast16.sys) that intercepts executable reads and patches floating-point calculation routines in memory to corrupt numerical results. Targets appear to be high-precision engineering and simulation software including LS-DYNA 970, PKPM, and MOHID — tools used in structural analysis, physics simulation, and hydrodynamic modeling. The name 'fast16' appears in the ShadowBrokers' leaked NSA 'Territorial Dispute' deconfliction list, linking it to nation-state operations. The framework features an embedded Lua 5.0 VM (predating Flame by three years), 101 rule-based code patching patterns, anti-security-product evasion, and SCCS/RCS source control artifacts suggesting Unix-background developers. YARA rules and IOCs are provided for threat hunting. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years](https://daily.dev/posts/researchers-unearth-industrial-sabotage-malware-that-predated-stuxnet-by-5-years-wcwfomcmb) · CSO Online · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#lua](https://daily.dev/tags/lua) [View this post on daily.dev](https://daily.dev/posts/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stu-lwjq7xgor) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet","url":"https://daily.dev/posts/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stu-lwjq7xgor","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stu-lwjq7xgor"},"datePublished":"2026-04-26T22:33:47.147Z","dateModified":"2026-04-26T22:34:18.723Z","description":"SentinelLABS has uncovered 'fast16', a previously undocumented cyber sabotage framework dating to 2005 — predating Stuxnet by five years. The framework...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a54cf127ea488cf81518570d0ecbb1f7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a54cf127ea488cf81518570d0ecbb1f7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stu-lwjq7xgor","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,lua","timeRequired":"PT34M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet"}]} ```