Security Now · 2026-04-29 · 2h 35m
Key moments - from our scoring
Substance score
25 / 100
Five dimensions, 20 points each
Steve Gibson and Leo Laporte examine FAST16.SYS, a Windows kernel driver discovered by SentinelLabs security researchers that represents a significant chapter in nation-state cyber warfare history. Built in 2005, this malware targeted precision scientific and engineering software - particularly tools like LS-DYNA used in nuclear modeling - by intercepting executable files at load time and subtly altering floating-point calculations in memory. Unlike typical espionage malware, FAST16 was engineered for sabotage: it modified calculations invisibly, leaving no disk traces and defeating standard antivirus detection, ensuring that even peer review and recalculation on different systems would yield identical incorrect results. The discovery emerged through digital archeology connecting Service Management XE to the mysterious fast16.sys kernel driver, with definitive attribution strengthened by references in the 2017 Shadow Brokers NSA intelligence leaks. This find reshapes understanding of cyber sabotage timelines, proving Western intelligence agencies deployed sophisticated digital weapons years before Stuxnet became the public reference point for state-level operations. The episode emphasizes implications for modern defenders: critical infrastructure and scientific systems must now account for subtle, mathematically-based manipulations rather than obvious attacks, making legacy malware analysis essential for understanding contemporary threat sophistication.
FAST16.SYS was a Windows kernel driver malware from 2005 that intercepted engineering software - particularly programs using Intel C compiler for physics simulations - as they loaded, injecting altered mathematical routines that subtly changed floating-point calculations without modifying files on disk, making detection nearly impossible.
SentinelLabs researchers discovered FAST16 through reverse engineering of Lua-scripted malware, finding references to the kernel driver within Service Management XE software, and confirming attribution through its mention in the 2017 Shadow Brokers NSA intelligence leaks.
FAST16, deployed in 2005, predates Stuxnet by five years and operated at seemingly higher stealth levels by silently altering calculations in memory rather than causing overt disruptions, suggesting U.S.-allied agencies had pioneered advanced digital sabotage before Stuxnet's 2010 discovery.
FAST16 specifically targeted engineering tools compiled with Intel C compiler, particularly LS-DYNA used in nuclear modeling and research, because these programs' calculations were mission-critical and alterations could derail months of sensitive research without detection.
The phrase indicated that even other state-level hackers and intelligence agencies should avoid tampering with FAST16, suggesting it remained an active operational tool in the NSA's cyber arsenal warranting compartmentalization and protection.
Our reviewer’s read on each dimension, with quotes from the episode.
The episode provides some substantive technical details about Fast16's mechanisms (memory patching, floating-point manipulation, Intel C compiler targeting), but the transcript is heavily summarized and marketed rather than genuinely conversational. Much of the content consists of repeating the same core claim - that Fast16 silently altered calculations - without layered insights or surprising technical details that would genuinely educate a security operator. The narrative structure is more journalistic than investigative.
It modified science and engineering software in memory - never altering files on disk - making detection almost impossible through normal anti-virus scans.
Identifying critical parts of these programs as they loaded and injecting altered mathematical routines, specifically changing floating-point (decimals-based) calculations by a small - but mission-critical - amount.
The episode recycles a fairly standard nation-state malware narrative - advanced rootkit, stealth, critical infrastructure targeting - that has been covered extensively in post-Stuxnet security discourse. The framing of Fast16 as 'pre-Stuxnet sabotage' is presented as novel but relies on established tropes about NSA capabilities and digital warfare precedent. No contrarian take or first-principles analysis distinguishes this from typical state-actor threat reporting.
Most security professionals point to Stuxnet - a U.S.-Israel joint operation discovered in 2010 - as the dawn of sophisticated state-level sabotage. Fast16, built and deployed years earlier, reveals that the playbook for digital destruction was already in use
As attacks become more subtle and targeted, defending critical infrastructure - and learning lessons from these discoveries - is more vital than ever.
The transcript provided is a summary/marketing article, not an actual podcast conversation. Steve Gibson and Leo Laporte are mentioned but no actual guest expert (researcher, reverse engineer, or operator) is featured speaking in the transcript. The episode appears to have lacked a domain expert guest - only the hosts discussing secondhand information from SentinelLabs researchers who are cited but not interviewed.
Steve Gibson and Leo Laporte detailed a remarkable find by security researchers
According to Steve Gibson, Fast16's brilliance lay in its subtlety and precision.
The transcript names specific tools (LS-DYNA, Windows server, Intel C compiler, Lua scripting) and references the Shadow Brokers 2017 leak, providing some concrete anchors. However, critical specifics are absent: no actual code samples, no specific CVEs exploited for propagation, no named operators or countries of origin (only 'NSA' in the title), no timeline beyond 'built in 2005,' and no quantified impact (how many systems affected, what specific research was actually disrupted). The evidence remains largely descriptive rather than empirical.
Scanning for software compiled with the Intel C compiler, frequently used in physic simulations and engineering tools like LS-DYNA (a nuclear modeling program).
A final clue tying it to state-level actors was its mention in the Shadow Brokers leaks - an infamous 2017 trove containing NSA cyber arsenal details.
This is not a transcript of a conversation but a marketing summary/article with quoted fragments from hosts. There is no evidence of questioning, follow-ups, pushback, or conversational depth. The hosts are cited attributing claims but are not shown engaging in dialogue, probing assumptions, or challenging the narrative. No dynamic discussion or productive disagreement is evident.
Steve Gibson noted that this discovery challenges the prevailing narrative of who leads in cyber capabilities.
As both hosts emphasized, this was cyber sabotage at its most elegant and devastating.
Computed from the transcript - who did the talking, and the words that came up most.
What if your engineering calculations secretly sabotaged your nation's best efforts? This week, we reveal how a newly uncovered 21-year-old NSA rootkit quietly corrupted scientific research in hostile states and why it changes everything you think you know about cyberwarfare. Bitwarden's CLI hit with a supply-chain attack. Commercial routers in Iran fail shortly before the war. Meta logging all employee activity to train replacement AI. GRC's DNS Benchmark Release 5. Two miscellaneous AI thoughts. A bunch of terrific listener feedback. Unraveling the diabolical history of "fast16.sys" Show Notes - Hosts: Steve Gibson and Leo Laporte Download or
Transcribed and scored by The B2B Podcast Index.
Inside America’s Pre-Stuxnet Cyber Weapon: What Fast16 Reveals About State-Level Malware Primary Navigation Podcasts Club Blog Subscribe Sponsors More… Tech Inside America’s Pre-Stuxnet Cyber Weapon: What Fast16 Reveals About State-Level Malware Apr 29th 2026 AI-generated, human-reviewed. Security Now ’s latest episode exposes the discovery of Fast16, an advanced state-sponsored malware that covertly sabotaged nuclear and engineering programs years before the infamous Stuxnet attack.
This revelation highlights how silent, precise cyber operations can impact global security - and why these discoveries shape our understanding of nation-state digital warfare. What Is Fast16 and Why Does It Matter? On Security Now , Steve Gibson and Leo Laporte detailed a remarkable find by security researchers: a Windows malware framework dating back to 2005 - five years before Stuxnet - crafted for targeted cyber sabotage, not just espionage. Unlike typical malware that steals data or causes overt disruptions, Fast16 was designed for silent sabotage .
It infected high-value targets, specifically those using precision scientific and engineering software, and subtly altered calculations behind the scenes, leading to incorrect results in critical projects like nuclear research. How Was Fast16 Discovered After So Many Years? Fast16 was uncovered through a combination of digital archeology and sharp investigative work. Researchers from SentinelLabs were tracing the origins of sophisticated malware using the scripting language Lua, common in complex cyber operations.
They stumbled on Service Management XE, a Windows-era software wrapper, which internally referenced a mysterious kernel driver: fast16.sys. Digging deeper, they found that fast16.sys was far more than a rootkit - a form of malware that hides itself deep in the system.
It wasn’t just hiding; it was actively intercepting and modifying executable files as they loaded , specifically targeting engineering tools used in nuclear and civil infrastructure. A final clue tying it to state-level actors was its mention in the Shadow Brokers leaks - an infamous 2017 trove containing NSA cyber arsenal details. Fast16 didn’t just appear there; it was flagged as “nothing to see here,” a phrase meaning even other hackers should avoid tampering with it. What Did Fast16 Actually Do?
According to Steve Gibson, Fast16’s brilliance lay in its subtlety and precision. It modified science and engineering software in memory - never altering files on disk - making detection almost impossible through normal anti-virus scans. Key functions included: Scanning for software compiled with the Intel C compiler , frequently used in physic simulations and engineering tools like LS-DYNA (a nuclear modeling program). Identifying critical parts of these programs as they loaded and injecting altered mathematical routines, specifically changing floating-point (decimals-based) calculations by a small - but mission-critical - amount.
Spreading stealthily across networked machines via Windows server vulnerabilities, ensuring any re-calculation or verification on another PC would produce the same (wrong) results. The result? Even highly skilled engineers or scientists, double-checking their calculations, could not detect the compromise. Design faults, simulation errors, or subtle misconfigurations stemming from Fast16’s manipulations could derail months or years of sensitive research.
As both hosts emphasized, this was cyber sabotage at its most elegant and devastating . How Does Fast16 Compare to Stuxnet? Most security professionals point to Stuxnet - a U.S.
-Israel joint operation discovered in 2010 - as the dawn of sophisticated state-level sabotage. Fast16, built and deployed years earlier, reveals that the playbook for digital destruction was already in use , and at a seemingly higher level of stealth. The operational timeline suggested Western intelligence agencies could have silently disrupted adversaries’ nuclear ambitions long before more famous cyber incidents came to light. What Are the Implications for Today’s Cybersecurity?
Steve Gibson noted that this discovery challenges the prevailing narrative of who leads in cyber capabilities. With Fast16, it’s clear the U.S. and its allies were pioneering top-tier digital sabotage long before these tactics were widely recognized.
Modern defenses must now consider not only obvious attacks, but also the potential for small, undetectable manipulations in critical infrastructure and scientific systems . The story also urges greater scrutiny of “legacy” malware, which may still contain operational secrets or inform modern threats. Key Takeaways Fast16 was an advanced sabotage malware built in 2005, designed to silently alter scientific software outputs. It leveraged stealth rootkit technology and scripting engines to patch memory, avoiding detection.
The malware targeted programs like LS-DYNA, linked to nuclear research, subtly changing calculations. Its discovery is a sign that state-level cyber sabotage predates Stuxnet by years. Fast16’s operational security and modularity highlight the sophistication of earlier cyber arsenals. Detection and attribution relied on reverse engineering, archival leaks, and expert analysis.
Today’s researchers are just beginning to unravel the scope and impact of legacy nation-state malware. Modern cybersecurity must guard against not just visible attacks but subtle data and process manipulations . The Bottom Line Fast16’s revelation changes our understanding of cyber sabotage history. It proves that highly advanced, stealthy digital weapons have shaped geopolitics in ways we’re only beginning to understand.
As attacks become more subtle and targeted, defending critical infrastructure - and learning lessons from these discoveries - is more vital than ever. Subscribe to Security Now for in-depth coverage of the intersection between technology, security, and national intelligence: https://twit.tv/shows/security-now/episodes/1076 Share: Copied! Security Now #1076 Apr 28 2026 - FAST16.
SYS Unmasking the NSA’s Most Diabolica… All Tech posts Contact Advertise CC License Privacy Policy Ad Choices TOS Store Twitter Facebook Instgram YouTube Yes, like every site on the Internet, this site uses cookies. So now you know. Learn more Hide Home Schedule Subscribe Club TWiT About Club TWiT FAQ Access Account Members-Only Podcasts Update Payment Method Connect to Discord TWiT Blog Recent Posts Advertise Sponsors Store People About What is TWiT.
Other episodes covering the same guests and topics, from across The B2B Podcast Index.
A 2005 Malware Find That Rewrites Cyber Warfare HistoryWhat's Up with Tech? · on Stuxnet90 / 100
Credibility, not Likelihood [The Industrial Security Podcast]The Industrial Security Podcast · on Stuxnet86 / 100
Rethinking Ransomware and Human Error in Industrial Security | OT Security Made SimpleOT Security Made Simple · on Stuxnet73 / 100
SN 1085: A SOTA State-Sponsored Campaign - AI's New Superpower: Loop Engineering69 / 100
SN 1084: The Residential Proxy Threat - Malicious Proxies in Your Living Room45 / 100
SN 1083: Patch Tuesday à la AI - Arch Linux Repo Under Siege38 / 100
SN 1082: The Malicious Use of AI - Anthropic's Red Team Report44 / 100
SN 1081: AI Captured the Flag - Personal AI: Productivity Superpower or Privacy Threat?35 / 100