Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results. Update | 07 May 2026 Executive Summary SentinelLABS has uncovered a previously undocumented cyber sabotage framework whose core components date back to 2005, tracked as fast16. fast16.sys selectively targets high-precision calculation sof…

https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet

sha256:e101fa0e9318413ce89d9f0200981ab90fcee59d747ab0b9f2b9e42dea67439a

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md515
url0
ipv40
ipv613
sha115
domain10
sha25615
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	explorer.exe	Open →
ip	18:15:06	Open →
ip	18:42:45	Open →
ip	16:34:57	Open →
ip	10:58:17	Open →
ip	08:35:46	Open →
ip	08:47:11

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports