A malware sample built for single-core Windows XP may be the first cyberweapon ever found- 245
April 24, 2026
Five years before Stuxnet became the textbook case for cyber-physical sabotage, something called FAST16 may already have been quietly corrupting the floating-point math inside engineering simulation software used for crash testing, structural analysis, and — according to researcher Vitaly Kamluk's presentation at Black Hat Asia — potentially Iran's own nuclear weapons development work. If Kamluk's dating holds up, FAST16 isn't just an interesting historical curiosity; it rewrites the starting point of an entire category of cyberweapon most of the industry assumed began with Stuxnet.
The discovery began as a hunch rather than a targeted hunt. SentinelOne's Kamluk wondered whether known nation-state espionage tools like Flame, Animal Farm, and Project Sauron — all of which shared a distinctive reliance on the Lua scripting language and its virtual machine — represented the actual beginning of that toolkit lineage, or merely its most visible chapter. Searching for earlier software sharing similar characteristics led to a malware sample uploaded to VirusTotal in 2016 containing an internal reference to "fast16." What made the sample unusual was that its techniques didn't match typical 2016-era malware at all — and SentinelOne's researchers separately recalled that the same string, "fast16," also appeared inside the infamous Shadow Brokers malware trove that surfaced that same year and was later linked to the U.S. National Security Agency.
The dating evidence Kamluk assembled is unusually concrete for malware attribution of this age. FAST16 will not execute on anything newer than Windows XP, and even then only on a single-core processor — a hard technical constraint, since Intel didn't ship its first multi-core consumer CPUs until 2006. Combined with other clues embedded in the code, SentinelOne's working estimate places FAST16's creation around 2005, meaning the malware's own architecture effectively fossilized the moment multi-core computing became standard, rendering it inert against any hardware built after that transition. What the sample actually does is precise and narrow: it installs a worm alongside a driver named fast16.sys that deliberately alters the output of floating-point calculations, while actively searching infected systems for specialized precision-calculation software used in civil engineering, physics, and physical-process simulation. SentinelOne's analysis identified the specific targets as three high-precision engineering suites in wide use during the mid-2000s — LS-DYNA 970, the PKPM structural analysis platform, and the MOHID hydrodynamic modeling system, covering use cases from crash testing to environmental modeling. The detail that elevates this beyond an academic curiosity is that Iran is believed to have used LS-DYNA specifically in its nuclear weapons program — meaning FAST16, if Kamluk's hypothesis holds, may have been engineered to introduce silent calculation errors into precisely the category of engineering software a state nuclear program would depend on, five years before Stuxnet took a very different, more direct approach to the same underlying goal.
Kamluk frames FAST16's significance as structural rather than merely chronological: in a paper co-authored with SentinelOne colleague Juan Andrés Guerrero-Saade, he describes it as bridging the gap between the earliest, largely undocumented cyber-sabotage development programs and the later, better-known Lua and LuaJIT-based toolkits that followed — a reference point, in his words, for understanding how advanced state actors think about long-term implants and a nation's ability to reshape the physical world through software rather than through kinetic means. Having disclosed his findings to the vendors of the affected engineering applications so they can check historical output for evidence of corrupted calculations, Kamluk closed his talk by noting that further discoveries in this lineage may still be waiting to surface — and dedicated the presentation to his late colleague Sergey Mineev, who he said had a history of finding similarly significant threats without ever seeking recognition for the work.
