Threat Profile
| Attribute | Details |
|---|---|
| Canonical Name | fast16 |
| Threat Category | Cyber sabotage framework / Calculation tampering malware |
| Platform | Windows |
| File Type | Windows PE executable (includes kernel-mode driver component: fast16.sys) |
| First Observed | Core components date to 2005; publicly disclosed 2016 (ShadowBrokers leak) |
| Prevalence | Low (targeted deployments in industrial/research environments) |
| Primary Payload | In-memory code patching of high-precision calculation software |
| Propagation | Self-propagating across networked systems in targeted facilities |
| Detection Names | fast16, Territorial Dispute component (NSA codename) |
| Target Industries | Manufacturing, scientific research, critical infrastructure, engineering firms |
| Operator Profile | Nation-state level; linked to NSA offensive cyber operations |
| Removal Difficulty | High (kernel-mode driver, memory-resident, requires specialized forensic tools) |
How It Spreads
Unlike consumer malware that spreads through email attachments or fake downloads, fast16 was designed for surgical deployment in targeted facilities. The framework includes self-propagation mechanisms that allow it to spread laterally across networked computers within an organization once the initial infection occurs. This makes it particularly dangerous in industrial and research environments where multiple workstations share calculation tasks or data. The original infection vector typically requires initial access to the target network—something nation-state actors achieve through various means including supply chain compromise, insider access, or exploitation of network vulnerabilities. Once inside, fast16 can move from machine to machine, seeking out systems running the specialized software it's programmed to sabotage. Distribution methods observed or associated with this threat family include: - **Network propagation** within targeted facilities using built-in worm-like capabilities - **Supply chain compromise** of software updates or hardware shipped to specific organizations - **Targeted intrusion** by advanced persistent threat (APT) groups with prior network access - **Removable media** spread between air-gapped systems in high-security environments - **Compromised installers** for legitimate engineering or scientific software packagesWhat It Does On Your Machine
The core component of fast16 operates as a kernel-mode driver (fast16.sys) that runs with the highest privileges on your Windows system. This gives it the ability to intercept and modify how other programs execute, particularly targeting software that performs precision calculations—CAD tools, finite element analysis programs, computational chemistry applications, statistical packages, and engineering simulation software. Instead of immediately crashing your system or encrypting files, fast16 waits for targeted applications to run calculations. It then patches the executing code in memory, introducing subtle mathematical errors into the results. A CAD program might calculate a structural load bearing as slightly higher than it actually is. A chemistry simulation might show a reaction as stable when it's not. Statistical analysis might shift significance values just enough to change conclusions. These aren't random errors—they're deliberate, targeted modifications designed to undermine the integrity of your work.Manual Removal — Step by Step
Isolate the System Immediately
Disconnect the infected computer from all networks—both wired and wireless. Disable Wi-Fi, unplug Ethernet cables, and turn off Bluetooth. If other computers in your facility might be infected, isolate them as well. fast16 propagates across networks, and keeping systems connected risks spreading the infection to clean machines.
Boot Into Safe Mode
Restart your computer and press F8 (or Shift+F8 on newer systems) during startup to access Advanced Boot Options. Select "Safe Mode" to load Windows with minimal drivers. This prevents fast16.sys from loading automatically, giving you a chance to remove it. On Windows 10/11, you may need to use Settings > Update & Security > Recovery > Advanced Startup to access Safe Mode.
Identify Malicious Driver Files
Navigate to C:\Windows\System32\drivers and look for fast16.sys or suspicious driver files with recent modification dates that don't correspond to Windows updates. Enable "Show hidden files" and "Show protected operating system files" in Folder Options. Take note of any files you identify but don't delete them yet—you may lack the permissions even in Safe Mode.
Remove Service Registry Entries
Open Registry Editor (Win+R, type "regedit") and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Look for a key named "fast16" or suspicious service entries that reference the driver file you identified. Right-click and delete the entire service key. Be extremely careful in the Registry—deleting the wrong keys can prevent Windows from booting.
Delete the Driver File
Attempt to delete the malicious .sys file from the drivers folder. If you receive "Access Denied" errors, you'll need to take ownership of the file. Right-click the file, select Properties > Security > Advanced > Owner, and change the owner to your administrator account. Then grant yourself Full Control permissions before attempting deletion again.
Scan With Multiple Security Tools
Run comprehensive scans using at least two different anti-malware tools. Use both traditional antivirus (Windows Defender is sufficient) and specialized rootkit detection tools like GMER or Kaspersky TDSSKiller. Kernel-mode malware often requires specialized detection. Allow full scans to complete even if they take several hours.
Verify Calculation Software Integrity
If you use engineering, scientific, or statistical software on this machine, you must verify its integrity. Uninstall affected applications completely, download fresh installers from official vendor websites, and reinstall. Do not trust any calculation results produced on this computer before the malware was removed.
Check for Network Propagation
Before reconnecting to your network, scan every other computer that shared network access with the infected machine. fast16 is designed to propagate facility-wide. One clean system reconnecting to a network of infected machines will simply become reinfected. This is especially critical in industrial or research environments with shared workstations.
Consider Professional Forensic Analysis
Given the sophisticated nature of this threat, professional analysis is strongly recommended—especially if you work in manufacturing, research, or infrastructure. The consequences of incomplete removal or lingering calculation corruption could be severe. Document when you first suspected infection to help identify which work outputs may have been compromised.
Prevention
- Segment critical networks. Don't connect computers running precision calculation software directly to the internet or to general office networks. Use air gaps or strictly controlled gateway systems for critical engineering and research workstations.
- Implement application whitelisting. On systems running specialized engineering or scientific software, use Windows AppLocker or similar tools to prevent unauthorized executables and drivers from running. Only approved, verified software should execute.
- Monitor for unusual driver installations. Enable enhanced logging for kernel-mode driver loading events. Any new .sys files appearing in the drivers folder should trigger investigation, especially on systems that don't regularly receive updates.
- Verify software package integrity. Always download specialized software directly from vendors and verify digital signatures before installation. Supply chain compromise remains a realistic threat for targeted organizations.
- Establish calculation verification procedures. In critical environments, implement independent verification of important calculations using different software packages or manual checks. This creates redundancy that can catch corrupted results.
- Restrict removable media. Disable AutoRun for USB drives and implement policies requiring scanning of any removable media before use. In high-security environments, consider prohibiting removable media entirely on critical systems.
- Deploy endpoint detection and response (EDR). Traditional antivirus may miss sophisticated kernel-mode malware. EDR solutions monitor system behavior and can detect anomalous driver activity or memory manipulation that signatures might miss.
- Conduct regular security assessments. Organizations working with precision calculations in manufacturing, research, or infrastructure should undergo periodic security audits specifically examining the integrity of their computational environments.