Designed to cripple Iran’s nuclear enrichment program, the 2010 Stuxnet worm set a cybersecurity precedent as the first time a nation escalated its activities from strategic espionage to sabotage in cyberspace. Now, a new discovery suggests such operations were in full swing years before Stuxnet came to light.

Researchers from SentinelOne have tracked down samples of a malware framework that was active in 2005 and targeted engineering modeling software by corrupting high-precision floating-point arithmetic operations.

One component of the framework, a kernel driver called fast16.sys, is briefly mentioned in the 2017 Shadow Brokers leak of documents covering exploits and tools used by US National Security Agency cyber teams.

“This 2005 attack is a harbinger for sabotage operations targeting ultra expensive high-precision computing workloads of national importance like advanced physics, cryptographic, and nuclear research workloads,” the SentinelOne researchers said in their report.

The malware framework uses a variety of techniques that are considered very advanced for malware from that era. A copy was uploaded to the VirusTotal online scanning engine almost a decade ago but remained undetected until researchers went on a hunt for pieces of malware that embed a Lua virtual machine.

The malware uses more than 100 rules to identify the exact workloads it should sabotage. While the researchers don’t know exactly what those workloads were, based on those rules they’ve narrowed down the list of targeted applications to three engineering programs, one of which appears in reports about Iran’s nuclear program and another being widely used in China for construction and structural design.

Chasing Lua-enabled malware

Lua is a programming language that originated in the early 1990s and is very popular in game and embedded systems development. Its primary attraction is that it can be embedded into existing C and C++ applications as a scripting engine.

Lua is used in modern malware to provide a way to obfuscate and deliver payloads in the form of scripts that get loaded and executed by the embedded Lua VM inside the main loader. One of the first threat actors to employ this technique is the Equation Group, an APT group that’s widely associated with the NSA’s Tailored Access Operations (TAO) team.

“We wanted to determine whether that development style arose from a shared source, so we set out to trace the earliest sophisticated use of an embedded Lua engine in Windows malware,” the researchers said.

This led to the discovery of a file called svcmgmt.exe, a malicious executable from the Windows 2000/XP era, originally created in 2005. The file is a modular service binary that uses encrypted Lua bytecode for most of its logic and includes two payloads: a file called ConnotifyDLL and one called fast16.sys.

In addition, svcmgmt.exe can execute additional Lua payloads dubbed wormlets that are used for propagation to other systems. For example, one of the identified wormlets, called SCM, attempts to copy the malware to network shares and then execute it as a remote service. This makes svcmgmt.exe the earliest documented Lua worm.

An unusual rootkit that corrupts floating point calculations

The fast16.sys payload is even more interesting as it is loaded as a kernel filesystem driver that can intercept and modify executable code when it’s read from disk. Malware components that install themselves as kernel drivers are called rootkits because they provide the highest possible privileges on the system.

In the Windows XP era, when system drivers didn’t require trusted digital signatures to be installed, rootkits were common and were used to hide the malware program’s components and activity. However, fast16.sys has a very specific purpose.

The driver monitors for the execution of .exe files compiled with the Intel C/C++ compiler, injects additional sections in their headers, and then applies a complex set of 101 bytecode pattern matching and replacement rules.

While some of the logic targets typical x86 instructions with the goal of hijacking execution flow, one injected block stands out as highly unusual for malware operations: a complex sequence of Floating Point Unit (FPU) instructions dedicated to precision arithmetic and scaling values in internal arrays.

When the researchers took those pattern matching rules and ran them against a large corpus of legitimate software from that era, only 10 files matched. All were calculation tools used in domains such as civil engineering, physics, and physical process simulation.

“The FPU patch in fast16.sys was written to corrupt these routines in a controlled way, producing alternative outputs,” the researchers said. “This moves fast16 out of the realm of generic espionage tooling and into the category of strategic sabotage. By introducing small but systematic errors into physical‑world calculations, the framework could undermine or slow scientific research programs, degrade engineered systems over time or even contribute to catastrophic damage.”

Furthermore, due to its ability to infect other systems over the network, it’s likely that more engineering workstations and servers in an environment would have been compromised, so attempts to verify the calculation by running the same simulation on multiple systems could have returned the same bogus results.

Engineering simulation targeted

SentinelOne identified three software programs that contain code matching the patching engine. One, LS-DYNA version 970, is an engineering simulation software suite that uses high-precision calculations to determine how materials behave under extreme conditions, such as high-speed impacts, crashes, explosions, metal forming, and so on.

The software was used in many industries, including automotive, aerospace, defense and manufacturing, but is also mentioned in public reporting related to Iran performing tests on warheads in connection to its AMAD program for developing nuclear weapons.

Another likely identified target, known as Practical Structural Design and Construction Software (PKPM), is a CAD suite widely used in civil engineering and building design in China. The software can simulate concrete shear design for beams and columns, providing seismic, wind, and load analysis for high-rise buildings.

The third potential target that matched the rules, Modelo Hidrodinâmico (MOHID), is an open-source water modeling system developed at the Instituto Superior Técnico in Lisbon, Portugal. The software covers hydrodynamics, water quality simulation, sediment transport, oil spill modeling, and Lagrangian particle tracking.

Implications

The SentinelOne researchers could not definitely say which workflows from these three possible programs were specifically targeted by the malware, but the implication is clear: Strategic industrial sabotage using malware was being performed by nation-state actors as far back as 20 years ago, before Stuxnet was used to damage uranium enrichment centrifuges at Iran’s nuclear plant in Natanz by injecting malicious code into programmable logic controllers.

“If I had to guess, I think the target was the simulation of specific material physics, and the implant was intended to mess with their characteristic curves (e.g. stress-strain),” independent researcher Ruben Santamarta, who also analyzed the fast16 FPU patching code, posted on LinkedIn. “For example, this would make engineers think something is more resistant than expected, when in reality, it would fail earlier than expected … as in Stuxnet.”

Santamarta, who has been researching proof-of-concept attacks against nuclear-related devices and software, said that finding something in the wild that’s potentially capable of causing physical failures by sabotaging the design phase represents a paradigm shift.

“The thing is, it happened 20 years ago, so it would be interesting to revisit some of the failures in certain countries over the years, stare at the monitor for a while, and just ponder the possibilities,” he posted.