PULSE NAME
fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet
WHITE AlienVault 2026-04-24 Modified: 2026-04-24
49
IOCs
MEDIUM VOLUME
Researchers uncovered fast16, a cyber sabotage framework from 2005 that predates Stuxnet by five years. The toolset includes fast16.sys, a kernel driver that selectively targets high-precision calculation software by patching code in memory to corrupt computational results. Combined with self-propagation mechanisms via a Lua-powered carrier module (svcmgmt.exe), the framework spreads across facilities to produce consistent inaccurate calculations. This operation represents the first documented instance of strategic cyber sabotage targeting ultra-expensive computing workloads in advanced physics, cryptographic, and nuclear research. The framework uses an embedded Lua virtual machine predating Flame by three years and appears in the ShadowBrokers leak of NSA Territorial Dispute components with the evasion signature: 'fast16 *** Nothing to see here – carry on ***'.
Indicators of Compromise (15 / 49 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256
TYPEINDICATORDESCRIPTIONCREATED
FileHash-MD5 cb66a4d52a30bfcd980fe50e7e3f73f0 2026-04-24
FileHash-MD5 075b4aa105e728f2b659723e3f36c72c 2026-04-24
FileHash-MD5 0ff6abe0252d4f37a196a1231fae5f26 2026-04-24
FileHash-MD5 1d2f32c57ae2f2013f513d342925e972 2026-04-24
FileHash-MD5 2717b58246237b35d44ef2e49712d3a2 2026-04-24
FileHash-MD5 2740a703859cbd8b43425d4a2cacb5ec 2026-04-24
FileHash-MD5 410eddfc19de44249897986ecc8ac449 2026-04-24
FileHash-MD5 49a8934ccd34e2aaae6ea1e6a6313ffe 2026-04-24
FileHash-MD5 af4461a149bfd2ba566f2abefe7dcde4 2026-04-24
FileHash-MD5 cf859f164870d113608a843e4a9600ab 2026-04-24
FileHash-MD5 daea40562458fc7ae1adb812137d3d05 2026-04-24
FileHash-MD5 dbe51eabebf9d4ef9581ef99844a2944 2026-04-24
FileHash-MD5 e0c10106626711f287ff91c0d6314407 2026-04-24
FileHash-MD5 ebff5b7d4c5becb8715009df596c5a91 2026-04-24
FileHash-MD5 f4dbbb78979c1ee8a1523c77065e18a5 2026-04-24