Skip to content
Discovery of Fast16 Malware: Precursor to Stuxnet Targeting Iranian Nuclear Program

Discovery of Fast16 Malware: Precursor to Stuxnet Targeting Iranian Nuclear Program

First seen 27 Apr 2026, 08:32 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •April 28, 2026 at 08:04 UTC
  • •Fast16 malware predates Stuxnet by five years, dating back to 2005.
  • •It targets high-precision computing systems, subtly corrupting mathematical outputs.
  • •The discovery alters perceptions of early state-sponsored cyber sabotage capabilities.

Researchers at SentinelOne have uncovered a malware framework named fast16, which dates back to 2005 and predates the infamous Stuxnet worm by five years. Fast16 is designed to subtly corrupt high-precision mathematical computations, specifically targeting systems involved in nuclear and engineering simulations. The malware operates by embedding a Lua scripting engine within its binary, allowing it to modify outputs without detection. Its delivery mechanism resembles a 'cluster munition,' deploying multiple payloads across vulnerable systems. Fast16's discovery challenges the timeline of cyber warfare, indicating that sophisticated state-sponsored cyber sabotage efforts were underway long before Stuxnet became public in 2010. The malware's components were found to reference critical engineering software used in Iran's nuclear program, suggesting a targeted approach to undermine its capabilities. The implications of this finding extend to understanding the evolution of cyber weapons and their potential impact on national security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 171d ago How this analysis works

Timeline

2005-08-30
Fast16 malware binary compiled.
2010-01-01
Stuxnet worm publicly identified.
2016-10-01
Fast16 file uploaded to VirusTotal.
2026-04-20
Fast16 analysis presented at Black Hat Asia.
2026-04-26
Fast16 malware discovery reported by multiple outlets.

More articles in this cluster (17)

Following this threat?

Track Fast16 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed