Fast16 Malware Sabotages Nuclear Test Simulations by Altering Data

A newly analyzed cyber-espionage framework called Fast16 has revealed one of the most precise and covert sabotage operations ever uncovered targeting nuclear weapons simulations by silently manipulating critical test data.

Researchers confirm that the malware didn’t just infiltrate systems it altered the scientific results themselves.

Fast16’s core capability lies in its highly selective “hook engine,” which modifies application behavior in real time. Rather than broadly corrupting systems, the malware activates only under very specific conditions tied to nuclear detonation modeling.

For example, it monitors simulation parameters and triggers only when the material density exceeds 30 g/cm³ a threshold associated with uranium under extreme compression during a nuclear implosion.

Symantec said in a report shared with GBhackers, Fast16 was specifically engineered to interfere with uranium compression simulations inside LS-DYNA and AUTODYN, two widely used physics engines for modeling explosions and material behavior.

This level of awareness strongly indicates that the attackers understood nuclear physics workflows in detail.

The malware focuses on high-explosive simulation models, particularly those using specific equations of state (EOS) such as Jones-Wilkins-Lee and Lee-Tarver, which are commonly used in modeling detonation physics.

Fast16 Malware Sabotages

Once embedded, Fast16 alters output values in subtle but impactful ways. Researchers identified three main tampering mechanisms:

• Mechanism A reduces calculated values to 10% of their true output once certain thresholds are met.

• Mechanism B targets stress tensor values in LS-DYNA simulations, gradually lowering them to as little as 1% under high-density conditions.
• Mechanism C affects AUTODYN simulations, scaling pressure outputs down between 8% and 42% depending on the software version and parameters.

These manipulations distort how uranium compression behaves in simulations. In practical terms, this could make a design appear viable when it is not or наоборот, cause valid designs to fail.

A simple way to understand this: imagine a speedometer that always shows 40 km/h even when the car is going 100 km/h. Engineers relying on that data would make completely wrong decisions.

Evidence suggests Fast16 was not a one-time attack but part of a sustained campaign. Researchers identified up to ten different malware builds, each tailored to specific versions of LS-DYNA and AUTODYN. This indicates attackers continuously tracked software updates and adapted their tools accordingly.

An EOS is a mathematical model that determines how a material’s pressure changes when its volume or density is compressed or expanded. 

The malware also spreads laterally within a network using shared drives and credential impersonation, but is intentionally designed not to leave the targeted environment reducing the chance of discovery.

Its stealth extends to installation. Fast16 uses a kernel-level driver to intercept executable files, inject malicious code during loading, and maintain persistence using Windows registry tricks like Image File Execution Options (IFEO) hijacking. Meanwhile, it actively avoids systems with known security tools installed.

Fast16 represents a rare class of cyberweapon designed not to steal data, but to sabotage scientific truth.

By corrupting simulation outputs, it could delay or derail nuclear weapons development without triggering obvious alarms.

Security experts compare it to Stuxnet, but note that Fast16 may predate it by several years, with components dating back to around 2005. Its deep integration of software engineering and physical science knowledge sets it apart from typical malware.

Start Density	End Density	Tamp Down (% of true value)
30g/cm3	60g/cm3	42%
30g/cm3	40g/cm3	10%
30g/cm3	47g/cm3	10%
30g/cm3	48g/cm3	8%

Although it’s unclear whether modern variants exist, organizations working with sensitive simulations should take precautions:

• Monitor and audit kernel drivers, especially unsigned or unfamiliar ones.
• Enforce strict application control to block unauthorized executables.
• Deploy advanced endpoint detection tools like EDR solutions.
• Regularly validate simulation outputs against independent models to detect anomalies.

Fast16 serves as a reminder that cyberattacks are no longer limited to data theft they can quietly reshape reality itself, one calculation at a time.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.