The fast16 Mystery, Stuxnet, and the History of Cyber Espionage | Juan Andres Guerrero-Saade

It's very true, yeah, You can figure he. Played us a proper role in this. He's an extremely smart guy. And so let's start from the beginning. Where did the germ of this research idea come from? Was there something that caught your eye in a publication or did somebody just sort of say, hey, let's, let's kind of dig into this thing that we found in The Shadow Brokers and see where it leads us? So it's a pretty long running piece of research and and frankly one that I feel a little bit vindicated in in taking this long.

But for a while I just felt truant because technically I like I found the sample, I want to say seven years ago, maybe around that time. And it was part of like a broader effort where Silas Cutler and I got very into trying to follow up on this research into territorial dispute. So for folks that don't know, Boldusar Banksath, Boldy to his friends over at at Crisis Lab in Hungary, he put out this paper, I think it was in 2018 that talks about territorial dispute, which is this NSA program that was meant to deal with deconfliction.

So the, the concept of deconfliction, which, you know, I wrote a paper about back in the virus bulletin days, God knows how long ago. It's a pretty interesting one because essentially deconfliction in warfare usually refers to, you know, you, you wanna know where your friendly troops are so that you don't bomb that place and accidentally kill, you know, British troops, right, just 'cause you didn't know that they were there. So it's a pretty important thing to, to understand that. And folks don't get the intricacies of deconfliction, for example, right?

Like we're in a shared theater of war and you know, the Russians aren't necessarily our enemies, right? Like we might all be going towards the same objective, but you know, how much do you let them know where you are? And if they and if you don't, you know what happens when they accidentally bomb one of your positions? All of those complexities in deconfliction, in actual warfare are kind of translating into some kind of unusual corollaries in the cyber side, which is everybody's being stealthy when they get on a box, right? When you hack a computer, you're not announcing yourself to anybody else.

Most folks don't seem to be sharing about their Intel operations. They're not necessarily letting each other know where they are. So then the question becomes, how do you keep yourself from landing and living on a box that's already been hacked by, you know, another APT group or a variety of other APT groups who may then proceed to mess with your operation or, you know, in a variety of ways or even just hide things from you because this is back in like the rootkit era. So that's like my very long winded way of saying, you know, there's this whole thing around territorial dispute as a as a solution that NSA operators had developed where it would basically check for certain file names and certain signatures and let the operators know, hey, you know, there's some friendly tooling here, you know, kind of leave it alone. There's some, you know, there's somebody else's malware here pull back.

And in, in some cases, there's this one file called driver list or DRV under score list that it's like 250 kilobytes. It's almost nothing. It's just like a, a, you know, a, a text file. And it has some really interesting call outs right? Where it's like, hey, you know, this is a friendly tool. This is some, you know, there's a bunch of drivers that have NSA cryptonyms next to them. So you go, oh, wow. Like you can actually say like this component is called that. Like that was fascinating to us back in the day. And then you have somewhere they're just unknown and they're unknown to the NSA folk at the time, obviously unknown to us. And, and Silas and I got like super into like, OK, well, let's try to identify, you know, what do what did they know about that we didn't know about?

What did what did they run into that we may have never seen? And among those there was this like crown jewel, which was fast 16. And so this has been going on for years, right? Is, is my way of, of saying, and we found the sample what we didn't really know what it was. So I'll take a, I'll skip a beat there just so I I'm not like monologuing. Here. No, that's cool. I mean that's a great introduction to it. I mean, I've been, I, you and I both share a, a interest in history and I think also in like the history of this industry and sort of the way that these operations have evolved over time.

Because, you know, the cyber espionage world is like pretty young and it's also pretty small. Like a lot of the research that you and other folks that we know of done is kind of like the, the, the foundational research into this stuff, you know, looking at offensive tools that Intel agencies have used and things like that. So going backwards and saying, hey, what did we maybe miss at the time or what did we not realize was important in this whole corpus that we were looking at, I think makes a lot of sense. Because I'm sure that, I mean, you could probably just keep doing that for the rest of your career and still have plenty of ground to cover.

I think so. I mean, I would love for that to be the, the, the thing that I'm left alone to do, right. Like if I was doing like APHD or something and I could just sort of meander a bit like that's, I'd be happy to live in like the cyber paleontology land. I could forever. I don't, you know, I don't, I don't think that I'm going to get to do that, especially not with the way the industry is shaping up now. But every once in a while you still get to look back and say, you know, what are the roots? Where did this come from? And just how much have we missed? Because I think something like Fast 16 lurking in the shadows for this long and even hidden in plain sight, right? Like even when you know it's malware, you don't necessarily know.

You know, what is it? What is it doing? Why does it matter? It's a, it's a really good reminder that we don't really have a handle on this stuff. It's we can't really look at cyber espionage and say, oh, you know, we get it, we understand it. We've got this thing covered, right? Like there's no new stories. It's like, no, no, there's, there's, there's a lot of different dimensions to this and a variety of operations and a variety of possibilities and a number of threat actors and all kinds of tooling that it's not that we've misunderstood a lot of it, we've just never even latched onto right. So, so you know, it, it's, it's fascinating just because of the depth of our ignorance and, and it, it's to be expected in an information asymmetrical space like espionage. But it, it's still, you know, it makes it all the more rewarding to keep looking.

Oh, I can only imagine. Yeah, I mean, I mentioned Stuxnet at the beginning, and I think if you're constructing a Mount Rushmore of cyber espionage tools, like Stuxnet is the first entry, right? It's George Washington. You know, it's like, and it's probably the one that we, we meaning the general public know the most about, I would guess. You know, our friend Kim Zetter wrote a book about it. You know, there were a series of like from terrible to pretty decent movies and documentaries that are kind of about it.

We have a general idea of what it was meant to do and how that operation, you know, came about and who was involved and what the end result was. But even that, there's a bunch of missing pieces. I mean, I know you studied it pretty, pretty in depth, but I'm sure there are just like blank spots in the whole Stuxnet operation. You just like nobody really knows, or at least not publicly. Yeah, there's a ton of it. There's tons of it. And, and to the point, right around the same time, Silas and I, we went back to characterize what we refer to as Gossip Girl, which is really that's a code name assigned by Canadian intelligence. If you look back at the Snowden leaks, presumably to for some cluster of the Israelis, but in in any case, we like we we took that and we started to sort of dig into like what what's Gossip Girl?

We sort of looked at it as this what we were referred to as a super, a threat actor, which people didn't, people didn't love the term, but essentially what we were trying to say is like a super group, right? Like, think of it as like a, you know, an All Star band that produced Stuxnet. And it, it's really interesting because when you look at Stuxnet, there's basically a variety of, of malware platforms that are contributing to this thing. And, and it's built in a way that's meant to be modular and extensible and, and you know, as targeted and as capable as it is, it's also meant to somehow enable all of this contribution and, and cooperation between different teams and different countries that may never ever meet each other.

So it's, it was quite fascinating. And, and I bring that up because to your point about finding something new, even in that, when we started to look, we actually found a fourth platform that was involved in that early on called flower Shop or some people know it as Cheshire Cat. That contributed one of the early command and control modules to Stuxnet. And we called it Stux shop at the time. And that, you know, that placed it back to like 2006. So you're, you're always kind of like moving the needle. Like the more you look, you're like, this has been going on for longer than we thought.

This has been going on. The more people have been involved in this than we ever knew they were. It's a really interesting reflection of just how much happens in the shadows with, with espionage in general and with Stuxnet in particular. I think something that people forget is that it it is the thing that taught us what cyber espionage looked like. Which is funny because some people like to remark that it's not a cyber espionage operation in itself, it's it's a sabotage op.

But. You know, if you remember Caro Workshop and some of the old VB Virus Bulletin conferences back before Stuxnet, the discussions around espionage and cyber espionage were kind of rooted in possibility, right? Like, we would talk about it as like, yeah, it's probably happening, but we haven't really seen it happening in any kind of coordinated or, like, structurally interesting fashion. So, yeah, I'm sure we're sure it's out there, but who knows? And then Stuxnet breaks and people realize not just it's been happening, it's a cut above anything we've ever seen, but also it's been sitting in our malware collections for years and we just didn't know what to look for. And then you look at the publications and it's like, OK, well, Stuxnet breaks and then you go like Dooku flame, mini flame Gauss, like all these things all of a sudden just start like populate.

And I, I think it's not because they suddenly appeared on the scene, it's because researchers now knew kind of what to look for. Yes, I remember that era very well there. Was it it in my memory is kind of the delineation point between, you know, Stuxnet is kind of it, it's like pre Stuxnet and post Stuxnet. Like what we understood is cyber espionage was kind of this potential energy that was sitting there that like we, yeah, like you said, it's sitting at the top of the hill and it might roll down the hill at some point, but we're, we're not sure when it turns out it had rolled down the hill and like squished us all and we just didn't know yet.

We bought it. Built the city on top of the thing that rolled down the hill, right? Like it. It's been around since like 95 and we just had not caught on. Yeah, and you know, there were things like Titan Rain and, you know, Yep, if you want to go back far enough, you can like Cuckoo's Egg, the the Cliff Stole book. That's a perfect example. I mean, that was I think the first, like in any real way, public exposure of cyber and espionage, cyber espionage operations. Completely different scale and scope. But yeah, people do think of Stuxnet as a cyber espionage. But it was, yeah, it was the end goal was sabotage. You know, the the idea was to do some damage to the Iranian nuclear facilities.

But I think, I do think, and I catch myself doing this sometimes You think of it as like somebody in Fort Meade pushed a button and, you know, a centrifuge spun too fast in Iran and that was it. That's not, no, there was years and years and years of planning and cooperation and development and versions and all of that kind of stuff. It's, you know, it has this, the timeline of a normal real world espionage operation, you know. And it there's an implied espionage component as well, right?

Like some, some of the things that very much to the .1 of the reasons Dooku was discovered around that same time is that was very much an espionage operation and A, and A and an espionage. Like one of the true apex threat actors in in sort of in our world that had facilitated some of the components used in Stuxnet. And clearly that platform and flower shop and you know, the equation group stuff in Flame. They had all, to some degree, been employed in finding out the requisite information or getting the, you know, signing certificates or, you know, developing certain modules on those platforms that could then be all baked together into this logic bomb of a sabotage operation. That was Stuxnet.

But yeah, you know, if we're being really like nitpicky, Stuxnet in itself, not an espionage op, but for that to exist, for that to work, that came on top of a whole lot of cyber espionage and traditional espionage that enabled the op, right? Right. There was, there was, you know, handoffs of, you know, thumb drives if I remember correctly and things like that, that there was a whole lot of links in that chain. It was not just we sent some bad code to Iran.

Yeah, and, and, you know, and multiple versions of it, like you mentioned this before, there's a, there's a variety of Stuxnet versions and it's kind of funny because they're pretty much discovered backwards. This is like amazing paper. I think it's called the Stuxnet dossier by Symantec, right, by Liam Morechu and, and Eric Chen and Nicholas Felieri and those, those folks that like, worked at very early on. And essentially the, the part that people miss is there were different payloads, like there were different attempts to do the sabotage 'cause you know, you have these ideas and it, it's not like they were throwing them Willy nilly, right?

Like there was a whole lot of experimentation. They, they even got some of the centrifuges themselves both in you know what in the States and in Israel and tested and made sure that the attacks would work. But even then there was definitely a certain amount of like, hey, let's try this. Oh, you know, it's causing some damage, but not enough damage. Like, hey, let's try this thing. You know, what if, what if they spin really fast and then they stop? What if they slightly spin faster than they're supposed to and, and you know, and then slowly, like slower than they're supposed to.

What if we try this time and the other? So there's all these different versions of Stuxnet that that have different payloads and different logic to them and that just keeps kind of stretching back to about 2006 as far as we know at this point. And you know, we didn't intend for this to be a Stuxnet history lesson, but it's one of the more, you know, it's important to understand like the sort of background of this leading up to what you guys do. And I mentioned Equation Group earlier too, which that research you worked on that when we were both Kaspersky.

And I remember that not just me, but everybody in the company being pretty nervous about that being published. It was published at one of the early, not early, but one of the SAS conferences, Maybe Cancun. Yeah, Cancun 2015. OK. And I remember the day before that session sitting with Costin and probably you and some other folks, maybe many of I'm, I'm not sure, trying to like make sure that we had the wording like, you know, down to the syllable corrected and. Ryan doing his magic there.

Yeah, very much so. But just all of us being like very nervous about it. And even though all the news stories that came out afterwards essentially just pointed to NSA, it's important to remember you guys did not make that connection like explicitly in the in the research you just said this is what we found. Here's all the pointers. Here's where it might point go. Have fun like. I I'm glad that that was the case and that's something that, you know, we're doing even now with Fast 16 and, and I think that there's, there's good reasons to do it for Fast 16 just the same as there were good reasons to do it with equation group. And, you know, that gets vindicated later on. So essentially for folks that are unfamiliar with the the nuances of the attribution game, right? Like you don't really get the level of information that you want, if you're a really honest researcher, to be able to say, Oh yeah, this is NSA, right?

It was like, it was, it was Rob Joyce with the, you know, with the knife in the room with the whatever, right. Like it's, it's not a game of clue. You can get a whole lot of pointers and like small little things, right? Like language artifacts and and time zones and things are compiled and you know this bug and this thing lets us know that this thing was happening, right? Like when when Silas and I discovered flame 2 point O, it had looted everybody in part because these guys were so clever that they started backwards.

Like they started time stomping the new versions of flame to before when this like to a time before the suicide command that burned down the whole operation. And we figured out that there was like a bug in how they were using like I can't remember what component inside of it. It was, might have been like curl or something like that, which was pushing out a debug string that had the real date that it was being compiled. So the malware might have said pre 2012, but the debug string would say like 2014, right? And so it's little things like that that let you know people are like, oh, surely a nation state would never dude, people are fallible.

This stuff is complex. You're in a rush. Your real job, part of your job is tradecraft and making sure that researchers don't latch onto you. But your real job is probably, you know, to try to stop something from happening or to try to learn something meaningful and in sort of real world terms. So yeah, mistakes get made, and that's the bread and butter of attribution. And even then what you've got to go on is not this person or this house or this building, It's, you know, just a, a lineage of these ephemeral components that we try to put together into something understandable.

So I think it was the right thing to do at the time to not go, oh, yeah, this is the NSA. Even though everybody could tell it was like a cut above and like there was all kinds of components and, and interesting things to it. And then when you look at the Shadow Brokers leak, one of my favorite things in the Shadow Brokers leak is actually a sorry, this is not sorry, not the Shadow Broker's league in Vault 7. There's so many of these things at the same time. Sorry, Vault 7 League of, of CIA tools allegedly right. Joshua Schulte leaking these things to WikiLeaks. If you look at Vault 7, there's a forum discussion. It's basically like how, you know, why did the Equation Group get caught?

Like, what did they do wrong? And it's a really interesting discussion between CIA operators. And they actually talk about one of the really key things in there is, well, this isn't all NSA, right? Like there are shared, there's shared tooling. There's things that, you know, so essentially, if you want to be really honest about it, had we come out and said this is NSA, we would have been wrong because there were contractor components. There were things that maybe are on the, you know, from the other side of the house.

And, you know, you're just when you do things like that, you can get yourself like a nice bump up in the news that that week, that news cycle, you get crowned king for a day. But but in the long haul, you're kind of screwing over the industry because people will repeat that mistake like it's gospel for time immemorial. That's exactly right. People, including journalists like myself, will Google if they weren't there, they'll just Google like equation group, and it'll come up with equation group equals NSA.

And that just gets fed back into the news machine. And that's how it works. Yeah. Yeah. So you mentioned like the contractor part of this. You know, we always are, you know, here in the West a lot of times point out like, oh, China has all these, you know, this whole contractor ecosystem that does offensive work for state agencies that maybe don't have the the wherewithal or they want to they push it off on a contractor. US has that exact same thing like we have not not it doesn't operate exactly the same way.

We within 20 miles of where you're sitting, there are 20 ish it miles. There are a lot of contractors that do offensive work. They do they develop offensive tools. They don't do the offensive operations per SE, but and. That's why you saw me kind of like, like wincing a little bit at the thought because like, I, I agree with you, there's definitely like a, a, a big contractor arrangement in many ways that has more to do with our bureaucratic failings as a nation than it has to do with, I think the, the kind of maneuvers that you see in other countries, right? Where you're like, oh, I, I want to be able to tell these people to do something that I am legally not allowed to do. Or, you know, we have such a thriving private sector here. I'd rather, you know, give this business to these enterprising young kids right in China and, and let them break the law on, on our behalf internationally,

right? Like when Chinese don't care. But here it's much more a matter of like, well, the pay scales don't really go that far up. So I can't even though this person already works here, I'm better off like having them leave and get rehired by Booz Allen and then like put them on the exact same contract, but now they can make the right money they should have been making if they worked in the private sector. And now like, look at that, an army of contractors with like TSSCI or so it's a, it's a little different. Yeah, it definitely is.

You're right. It's they're still. Super constricted, right? Like none of them are ever going to get to push the button the way they should. Right, right. Yeah, and they're Yeah, there's rules. All right, so let's get to fast 16. So when you started actually pulling on the string, you and Cam, Luke and and Silas. I'm glad you mentioned Silas. Another big brain who like you like. Can't not mention Silas. Right, Once he gets his like claws into something or decides he's going to do something like just watch out and that shit is going to get done. Did you have an idea where this was going to? Lead so not really right and and and I'm realizing this is like now like a 30 minute deviation on the original question, which is how do we find it right?

But Silas and I are working on the, the territorial dispute stuff. And in that process, right, we, we really obsessed over this. There's this one line that's really unusual across the rest of the file, which is fast 16 and it says nothing to see here. Carry on. Right, Right. Not your normal it. Was catnip. Are you kidding me right like there's so many lines, so many different files. This thing includes like, do you remember like Nero to like the, the, the application you used to like burn CDs, right?

Like those all have system drivers. Like all of that stuff is in, in driver list 'cause it's going, hey, this is benign, right? Like this is near OCD burning, you know, kernel component. And then you have this one thing that's just like, I mean, think about what we're saying, especially in the attribution lens when there's a component that's an NSA component, it has a cryptonem, it has a name, an operational name, right? So there's that when there's like tools by let's say you know, the CIA, in some cases they have a, they say friendly tool.

So what the fuck is nothing to see here? Carry on, right? Like, is it is it a friendly or it's not? It's not yours, but it's something you know about. But right. So we were obsessing over this thing and what was really interesting was like nobody had turned it up. We eventually find it in a kind of ass backwards way, which is we were also hunting for any component that included an embedded Lua VM. This was like a different project we were working on, right?

Like Lua virtual machines are like a common thing in this paradigm of Western espionage, cyber espionage. It's really fascinating to me. And, and the original paper I had wanted to write was one where we just sort of described these echoes across different Western organs and like, you know, Western including like Israel, for example, right? It's like this tradition or essentially this school of thought about cyber espionage where you see Animal Farm equation, sorry, Animal Farm flame, something we call Plexing Eagle. There's a bunch of different operations that use these embedded Lua VMS and they use them for extensibility. They use them to be able to like push out scripts that they can that'll just sort of like finish orchestrating the operation without them having to recompile the whole malware. And each one of these different platforms has implemented it in their own way, which is

interesting, right? It's not like you just kind of go and like you buy the Lua toolkit and you go, OK, now we too have the same powers as Flame, but they do, they do it in their own way. So we part of our research was like, hey, let's go find every executable of a low prevalence of, you know, that's kind of rare, That's sort of that's unusual. That includes an embedded Lua VM And you know, let's just cast a super wide net and come back. And as we're going through the results in this thing, there's tons of stuff, tons of just like video game cheats, for example, which is like something that people love, of course, for it's just like cheating at video games.

Big, big thing. We find this one sample. It's one very unusual, very old sample and just one. And it has this PDB path, this string in it that says that includes the word that includes fast 16 as a file name. And so like we just kind of like fall backwards into, oh, fast 16 is embedded inside of this executable. And Fast 16 is a driver it itself, right?

OK. And at that point, did you know what it it was a driver for? No, so, so this is where I think a little bit of like shade on us and a ton of credit to Vitali Kamluk, who like I've always known to respect them. The you know, the guy, the guy is, is a genius and a very understated person in his own right. Never seen him show off a day in his life. Like he's just a very humble person. If I could do half of the stuff that Vitaly can do you, you'd never hear the fucking end of it.

So, but he, so I look at fast 16 and I'm able to like kind of sorry. I, I look at this original executable, which is it's called service management svcmanagement.exe. We look at this thing and I can kind of reverse it and I find this encrypted thing and I find the VM and all these things that are really interesting. But then you look at fast 16, the driver and you go, I'm not entirely sure what the fuck this thing does right. Because normally a kernel rootkit, like any kernel driver from back in those days, is a rootkit, plain and simple.

Like they're all rootkits. And funnily enough, we were trying to use this as a hard eval for new, for AI models doing reversing 'cause we're like, look, this is the thing. This is a thesis of mine. I'm like, there's a way to evaluate how well these AI models are performing at reverse engineering very easily, which is elusive, undiscovered complex malware samples. There's no report out there. Nobody's taught you, nobody's led you by the hand to tell you what it is. I think it's a great way to evaluate whether these models are actually performing or whether they're just, you know, they're, they're cheating and they've memorized some things and they're kind of skipping ahead. So we were, we were trying to revert, we were trying to evaluate these these models by reversing fast 16 and some of this other stuff.

Every single model said it was a rootkit, like face value, like facing point and then like Vitali was able to lead Opus 4.6 I think by the hand until it was like able to get past. It's like it's bias and and sort of acknowledge that it wasn't a root kid. But all the other ones, you couldn't possibly convince them that this wasn't what it was because that's that's normally what you look at. So I looked at it, Silas looked at it. There's a coast and looked at it. A couple of other like very impressive reverse engineers looked at it and no one could figure out what it did.

And that's my just justification for sitting on this fucking thing for like 7 years because like this, you know, I feel like I said, I feel bad. I promised the paper at some point, but I'm glad we didn't release it because I think the the gut instinct, the thing, the the thing that you're kind of driven to do in this industry is like go seize the limelight when you can right, Like I found this thing and before anybody else can get it, I'm gonna can put my stamp on it and take a victory lap and like, you know, have everybody high 5 me for you know what a great threat hunter mommy made.

But but in this case, like it would have been a mistake because I think it would have kind of wasted. It's it's it's potential and the attention that it actually deserves to just come out and say, hey, we found this thing. It's kind of neat. Nobody's seen it before. It's super old and like has a rootkit and then you go cool, another rootkit. Nice. Vitali gets on this thing and like, of course he figures out there's this like patching engine, there's a state machine in it. This thing is basically implementing the same techniques that you get from antivirus engines where you, you know, you're looking for certain patterns of bytes and then you do something.

And as he's going through these rules, there's like 101 rules baked into the thing he figures out not just that like it's looking for certain byte patterns and that it might, you know, and it's, it has certain logic to modify some things. But then there's like a whole bunch of like FPU modification functions. And that's basically saying like there's a bunch of high precision calculation stuff. In it, this is where my brain shut off. I was. Like you're like what? What the exactly exactly? And that's when you realize like the true import of the thing, right?

So I don't know if this has been like too long of a tease for for what fast 16 does, but essentially the the way computers work, right? Everything is running through the CPU normally and then you have these special registers to do Floyd, sorry, floating point math. And that's, you know, the kind of thing that you need, let's say, for graphics, right? Like when you NVIDIA cards were originally, you know, entirely focused on that kind of math where you're trying to figure out like what, you know, what should all these polygons look like to try to make, you know, nice video game graphics? And how do we make that smoother and how do we calculate that faster?

And, and that's been sort of like the race to AI has, has, you know, was brought to you by video games originally and then, you know, expanded by the blockchain, which nobody needed. And then now you get AI cause 'cause the, the chips got to this capability of doing floating point math quite that well. But the thing that you originally needed floating point math for or was scientific research. So you needed it for like high precision calculations of like explosions and impact, like a car crashes, tensile strength tests, right?

Like there's all kinds of, you know, very real world, like how do we get this, you know, what materials do we need so this bridge doesn't collapse. And all of that is high precision calculations, which is what Fast 16 is designed to mess with. Yeah, that's the really wild stuff. There were a couple. I mean, there was a million things that I found fascinating about this One was that the list of things that it checked for, like the defense evasion list essentially that it checked for is like the most dated list of like there's like zone alarm is on there and like all this type of shit.

That was funny. But then like the fact that this thing was essentially designed to like muddy up the math in some extremely esoteric things that are, as you said, designed for extremely specific purposes. Like these are not general, general purpose applications that it's going to mess with it. And it wasn't, it wasn't doing it in an obvious destructive way. It was like sort of this very gradual, very subtle kind of sabotage.

So, yeah, and, and that's where the story gets truly fascinating, right? Like, I, I, I think Fast 16 was a fascinating mystery in a niche space. Those of us that are into cyber espionage, we know why we wanted to, to figure out what the fuck this thing was. But I couldn't possibly convince A layperson to care or a politician to care about it because why would they? When you start to understand the mechanism of what's being deployed here, it's an incredibly devious and incredibly interesting thing. And in all of a sudden this we go, you know, we, we cross the bridge into O we're seeing a sabotage operation unfold of some sort.

And it's pre Stuxnet by a while, right? Like pre Stuxnet. If you put Stuxnet at like the discovery time, the, the time that you're announcing, it's like 2010. So on. It's like 5 years before when, you know, Symantec was able to get back to like 2008 samples. So you know, you're kind of moving the clock back. I Silas and I find Stux shop which kind of brings the the work and platform back to like 22,000 and six. And then interestingly, if you look very closely, the domain registrations actual for Stuxnet components, sorry for Stuxnet infrastructure went back to like a late 2005 like November or something like that.

This Fast 16 sample is compiled, I want to say June of 2005. Like we're sort of like, so this is a pre Stuxnet component, pre, you know, whatever we know is the Stuxnet operation component that is doing this kind of like devious manipulation. And it's doing it in a way that I, you don't, I almost think of it more as like psychological warfare than I think that then then it isn't just a sabotage in itself.

It's basically targeting these calculations and slightly ratcheting up the numbers just within certain bounds. And what's interesting about what the larger carrier or propagator component is doing around fast 16 is that it it has the ability to use these what they call wormlets. Part of what makes this sample so interesting, right? 2005, this is pre Snowden and all that. It calls itself an, it calls, you know, part of its components, an implant. It calls, you know, it, it refers to its own spreading components as wormlets.

It, you know, has this Lua VM. There's all these things where you're like, holy shit, like this is like a glimpse, right? If you'd found this in 2005, you know, you don't know sort of what you've just uncapped and, and it part of The thing is, you know, it has these wormlets and it, it clearly it's a broader platform that's been, been, was developed for a lot more things 'cause this one only contains 1 wormlets. It's like just window shares. And the idea is that it'll infect other machines on the network. And when you realize, right, that what it's doing is just delivering this payload that modifies these calculations, you get into this kind of very devious aspect of the OP, which is, OK, you're messing with calculations.

But then, like, OK, I go, hey, this doesn't look right. I'm going to get up and go use a different computer or, or you know, some other piece of equipment inside of this lab. And it's it too is going to lie to me in just the right way as to the thing that I'm that I'm trying to, to figure out. So, you know, it's something that we used to hear about with Stuxnet of like surely the Iranians, and we know they did at some point started to think of their own scientists as if they were incompetent, right 'cause you're getting, you're getting help from AQ Khan. These things have worked in other places, they work in Pakistan.

Why the fuck can't we do it? And so you start to look at, at your own scientists and start firing people and moving things around. And like, surely those scientists must be like yanking their hair out because you know, you're right. Formula wrong answer is a pretty, you know, it's difficult thing. You usually think that's operator error, right? Yeah, that's exactly right. Yeah. You think it's pilot error because you've done these calculations using all of the same inputs and parameters, however many 10s of thousands of times or whatever the case may be, and all of a sudden you're getting these subtle errors and you can't figure out why. I can just picture, you know, a room of mathematicians or scientists or engineers just losing their damn minds trying to figure this out.

Yeah. I mean, it's brilliant and that now it's not a fully solved mystery, right? We got this far and I'm pretty happy and and sort of very proud of of the team getting there. And of course, Vitaly, you know, gets the the lion's share of the credit. Also Gabriel Bernadette Shapiro, who was building sort of these harnesses to try to use this, you know, AI for, for the reversing evals. But at the end of the day, you're still missing one key element of the story, which is, well, what, what was it sabotaging?

Like what was it modifying? So we, you know, we take the, the bites, the patterns that it was looking for. We wrote some rules around it. We started to hunt and we really end up kind of with three clusters of software. Which one? And so the, the, they're all kind of like 3D modeling, like scientific calculation type of software, unusual stuff that, you know, most of the folks listening to this would never have used. So one of them is like for, it's just like Portuguese application called Mohid. It's for like modeling like fluid stuff. So you think like.

Oh, like fluid dynamics? Yeah, yeah, exactly. So a lot of a lot of stuff around like, you know, this river and this thing and you know, again, beyond me, but that one's doing fluids. Then you've got one called PK PM in China, which is like a CAD software kind of thing. So they're for that, you know, you would think like how do we build this bridge sort of tensile strength stuff, Applied Materials type of calculations. And then then there's LS Dyna, which is used for all kinds of stuff.

And like that software has been around like forever. It's like it, it from, from I think it started in like Lawrence Livermore. And it's, it's what you use for like, you know, modeling how a jet wing would perform. Like what happens if you hit a bird? You know, how do you, you know, what happens with these explosions, like car crashes, those sorts of things where you need to kind of model a whole lot of particles and a whole lot of different things happening, each with their own effects, each with their own rules under like very stringent conditions.

And you need a very specific result. What makes this more interesting out of the three targets, even though I think they, they all kind of have their own interesting possibilities, is that LS Dyna, there's a report by the good ISIS is apparently what they're called the I don't remember what, what ISIS stands for, but it's like, it's this scientific research think tank. I'm guessing they had the name before, you know, ISIS got so besmirched of, you know, of, of beheading fame. And they have this report about software evidence that like Iran was violating the JCPOA terms through the use of certain software that was sort of meant to be kept from them. And, you know, it's quite clever. Like you go through all this scientific research that Iranian scientists are contributing and you go, well, the only way like you can get this is by using

this piece of software or you're outright stating that you're using this piece of software. So you know it. It's part of what they suggest is that LS dynam may have been used in the calculations for the early Iranian Ahmad nuclear program to try to figure out, you know, do we use this explosive or that one or COVID or whatever. So we've been like, I feel like I have to point to that because it's just like such an obvious thing to say, you know, why might you care about this? At the same time, you know, going back to our discussion about like researcher objectivity, we don't have it. Like we don't have that.

Like we don't have the, this is the exact workload. This is exactly what it's doing. So we're trying to refrain from it so as not to like overbias and over index in that direction. But considering that you this precedes an OP that famously and quite well resourced was focused obsessively on that program, you know, it doesn't feel like too much of A stretch to say, you know, is this a predecessor to Stox and this is an early attempt, Is this something that you did to like ancillary processes around the development of this stuff? We don't know, but yeah, it's it's part of sort of the fascination of the story.

Yeah, that's the interesting, outstanding question to me is did this actually work? Do we know whether this succeeded in any way? And it seems like the answer is we don't know. Well, I mean, I, we obvious we do not know, we have no way of knowing. I will say if these are, we do know certain things, right? We know that NSA operators on some in some capacity knew this thing existed and we know that it precedes a well funded, well long standing and for a time quite successful operation devoted to doing this at a larger scale, right.

So if we look at it as a prototype or as an early salvo into that program, my assumption is that they would have seen some, some success or a glimmer of, of promise right in, in, in what Fast 16 must have accomplished or could have accomplished at that time just by virtue of what subsequently happens. But we don't know. And you know, and I'd love to know, right? Like this is one of those situations where I'm like, I, I would love to see the, the cyber threat Intel industry and, and community sort of function the way it did around Stuxnet 2, where it's like it wasn't competition.

It was people openly throwing out findings and ideas. And, and to that extent, right? We've already heard from our friends in Symantec who've been contributing some stuff and like, you know, sharing certain samples with us and correcting certain byte patterns and stuff that we needed to kind of rescan on. And then, you know, researchers on Twitter. Oh God, I didn't boss. I'm going to forget the rest of his name. Anyways. Who who've started to, you know, kind of reverse some of the state machine themselves and say, look at these intricacies of like the patching.

So like, you know, we, we really welcome it in particular because you're kind of fighting the worst kind of the worst enemy in, in cyber threat Intel and, and, and sort of the crux of cyber paleontology, which is this, this decay of data and this like inaccessibility to any kind of information in the before time, right? Like who is really holding on to samples and components and logs and what have you about stuff from, you know, 2000 and 567 and so on.

And even there there's like a, there's a not great culture around, you know, even if you have it, you don't necessarily share it. That stuff is not all getting dumped on virus total. You know, I can't go and ask, you know, Kaspersky or whomever, hey, like give me every malware sample you have from 2010 and before it. It's treated almost like intellectual property. It's like you own the malware and, and then you get acquired and somebody just some, some aspiring, you know, private equity dude goes, hey, why the fuck are we paying $40,000 to store this stuff? Click delete and like you'll never see it again. So it's, we're holding out hope upon hope that somebody's still sitting on, on some other stuff.

And it's the only sample of this platform that we've seen. And it is a platform. There's no way that it was only ever used for one thing. Yeah, it wouldn't make sense, right? Like in the. Design it was over, it's over engineered if it like if you're, you're telling me it has like the ability to have these modules and wormlets and whatever it's over engineered for, for what it's being used for in this. Case, so you said this is the only sample and you were you were talking about it before. Where did that, Where did you find that sample? Like where does it exist?

Was it part of the Shadow Broker leak? All we had from Shadow Brokers was the reference like the line that said fast 16, the sample is on BT some. So, you know, we, we, we don't go into the, the submitter too much just 'cause, you know, just out of respect for, for Vt and like how they like to think about sort of their, their, their submitters. The sense what we get is that somebody dumped a very old, like a whole collection of malware that included a whole bunch of old stuff into virus total at some point in like 2016 or something like that.

And then we happened upon it in this wider swath as we were trying to check all this territorial dispute stuff. And then all of the flame 2 point O research, like the Gossip Girl research, we collect just a massive amount of stuff that, you know, we never push it out to anybody else because the, the false positive rates are like through the roof. But the idea was let's grab all these things that have interesting traits to them and just put them in a bucket that we can work with, you know, with less latency and less computing effort, right? Like when you have a, when you go from A7 petabyte malware collection to, you know, well, here's 2 gigs or 10 gigs a worth of stuff.

Like it's a much more tractable problem. And we just so happened to have this thing in there. You go in it for a different reason, and you end up figuring out that what's embedded inside of it is is pure gold. It's kind of crazy. I mean, it's like the the equivalent of walking through like an antique mall and you know, stumbling upon something like really cool, like, you know, antique in this case being 20 years, which is just, you know, that's. Leonardo. DiCaprio standards? Yes.

Would Leonardo DiCaprio date this malware? No. It's too old. Yeah, sorry. Sorry Leo, people catching strays out here my. Bad. It's a great threshold, right? Yes. So are there any like, aside from like, you'd love definitive answers on whether this worked and you know, somebody from Fort Meade to raise their hand and be like, hey, that was us. Thanks guys. Yeah, cool. Are there any other like outstanding avenues of research for this specifically do you think?

I mean, the there absolutely is. And like, to me as a researcher, there's more, there's more questions than there are answers, particularly around the platform. There's nothing we find with like shared code, right? Like, you know, think about it, right, it's 2005. It's not like they're worried about people doing code similarity analysis at scale, right? That's something that that got pioneered in in the mid, you know, twenty 10's and you know, part of that, you know, shout out to Sergey Menev. You know who who was the person inventing a whole lot of these things?

So the fact that we see nothing, nothing that connects to this is fascinating. A OK, is this the stealthiest thing that ever lived? That's one thing. You have this obvious bias with the data sets, right? Like things are, you just don't have that many data sets that go that far back. Then you have to talk about sort of like the telemetry generation. And you know, you saw the list, right? So if they're worried even about zone alarm, right, Are they ever existing on a box that would have had a some kind of security component that might have ever collected it?

Or are you waiting for an incident response to sort of somehow magically turn this out? I don't know. The more that I kind of go down that list, the more it makes me think that like if anybody has this, it'll be Microsoft, right? Like if it hopefully, hopefully Microsoft was collecting samples in 2005 and hopefully they've held onto them. And hopefully you can still scan through some of that stuff. And and if Microsoft wants to turn out like their their malware museum from like the pre twenty 10s, like I'll happily live in there and give them credit to Kingdom come.

But so far it just you just don't have any where to, you don't have that many places to go and chat. That is probably about the only place that it might live, yeah. That's my guess, right? Yeah. And I honestly don't know that they were back then because that was at the very, very beginning of them even having security software, you know, it was pre defender, it was pre all of that stuff. So I don't.

I don't even know. You never know, right? Like this industry, this space surprises you. Like Moonlight Maze. When we did Moonlight Maze, I called that like a miracle, right? Like it was like this this archaeological miracle that this one guy, David Hedges, this one operator who happened to have had one of the boxes in his organization get popped, happened to help the FBI collect stuff and then happened to not turn all of it over and happened to keep a copy and keep the machine for 20 years. And and just so happened to answer the call when Thomas called and handed us this stuff because the FBI destroyed all of it and the rest, you know, after a certain amount of time and the rest of it lives in the IC.

So like we were never we were just never, ever going to see this except for this one outlier. So, you know, I think life has a life finds a way in threat Intel, you know, and the. Isn't there a picture of you with that machine somewhere? The moonlight wings? OK, Yeah. Yeah, yeah, it so we it the the the I. Was trying to remember OK. The original machine is in the spy museum now. So, David. David. David David was donated. So if you guys are ever in DC, the the original command and control server is and and the spy museum next to Siemens PLC right to from from sort of the the Stuxnet. Guess where that's from?

Yeah, that lore. So it there's a nice little room of cyber espionage stuff that's worth. Paying right museum is dope like for for people that like if you have any interest in like cyber just espionage in general, that place is that and Air and Space are the two coolest museums yeah you have to. DC it's worth, it's worth saying for the folks who came to DC like five years ago and went to the spy museum that used to be this, like kitschy it was. Tiny it. It was like a children's exhibit type thing like that, you know, So it's like a magic.

Shop. Yeah, exactly, exactly. You need to like you need to they went non profit, they got an amazing set of donations and now they have like a five story like custom building just full of grad. So if you haven't gone, if you're into espionage like that is definite looks like Mecca you got to go visit. I got, I don't know if I've ever told this story on the podcast before in I want to say it was 97. It must have been. I got to go to the to Langley, to CIA. They had like a for the 50th anniversary. Maybe it was 98.

They did like a friends and Family Day and one of my best friends worked at CIA, so I went with him and I got a little tour of their internal museum there, yo. And it was just like, it was like maybe like 100 square feet that you got to see, but it was still like, that was incredible. But like, imagine if at some point we get that with, with cyber espionage tools where there's like, we'll walk you through this archaic shit that we built that is of no use anymore. How fucking cool would that be?

That's your dream, dude. Oh yeah, come on, I that that's where I, I, I, I just retired to be the curator of this little, this little malware shop of horror somewhere. But you know, in a sense, we've been trying to do this sort of as a labor of love, right? Like there is no jet, there's no immediate defense benefit to do in cyber paleontology folks think, I think, you know, I would push back on some of that considering that in some cases we have found things that are still active that folks thought were just not around, right?

Like, you know, there is there is very much a point to doing it, but it's hard to justify sort of the long trajectory of saying, oh, let me, let me cast my net 20 years ago and I swear it'll come back somehow. And, you know, bringing it back to fast 16 in this case, The fascinating thing about it is it's the same attack that you would design to fuck with a frontier lab, right? Like if you think about it right, like we're we're seizing upon the fact that like 20 some years ago, you already had the sort of prototype of what you would want to do to a DeepSeek or you know, one of these these national labs of. Well, let me just fuck with your calculations just a tiny bit. Just enough to throw the trajectories off, just enough that like, you know, maybe the 100th token suddenly starts to go wonky, right?

Like and and it's just a silent thing, just lurking in the background. The crazy. Thing to me is that in that era, in like the 2005 time frame, the folks that were doing this kind of work in NSA or CIA or maybe, you know, in Israel or maybe the UK, we're kind of doing it in a vacuum. They didn't have like, you know, they didn't have stuff to like any history to look back on of this stuff and like what worked and what didn't.

You know, they had like two or three years of their own operations or, you know, 10, let's say 10. OK, but like a, a very small sample size. And you, you guys actually mention it in the report. I meant to bring this up that in, in I love how you wrote it in like this very kind language of like, it's evident that these people use Unix at some point. So you're essentially saying these are old? Bastard Gray beard. It's some of these fucking Gray beards over here, right?

Like it's probably somebody at like one of these like research labs somewhere, right? It's. LBL or Livermore or something or, you know, whatever. They just called up some dude in a Plaid shirt with a long beard and we're like, hey, do you know how to do this? Oh sure, yeah, I got. I can do. That that's easy, right? Why not? Yeah, I, I, I think it goes to there's, there's an aspect of this that really fascinates mostly me, as far as I can tell, which is like just almost entirely there's an audience of one for some of this work, which is like, look, these guys have been at the reason I was like kind of shaky before when you're like, oh, you've got a few years behind him.

Well, it seems that some of these efforts in NSA at least went back to 95, right. So like they do have some time behind them. Does that mean they know how to do these things? No, they're, I mean, they're obviously innovating in this space and, and being truly crafty and in sort of these fascinating ways. But I also think that they've, you know, that they have discovered and understood and tried to solve really complex problems that, that in some cases were only just coming to to think about, right? Like, I, I, I have to admit something. I, I have, and this is gonna be a hot take. I doubt it's gonna go over super well. But like, I really resent the people who had access to the Snowden archive and chose to only put out documents that were related to some sensationalist bullshit that they wanted to talk about.

Right? Like, great, there's bases in whatever country or like you'll never believe what journalists got, whatever cool you have access to. Like some of the most cutting edge research that humanity has ever done in computer science, period. And like the only document that we get was it. Was like Verizon was spying on your on your phone. Calls yeah, there was like, you know, there was sensationalist shit and there's one there's one document like called the I think it's like the how Braun Institute machine learning problems book or something like that.

And it's like the one where you get like, hey, how do you handle this like really complex bit of whatever to to try to spy on this many phone calls Like how do you how do you do you know, how do you encode that data? How do you handle a stream of information that's like fucking 10 Gigabit and somehow parse out these things when computation only? It would take you so much to just sort of figure out how to you know, how to parse those streams and then, you know, figure out which ones you want. And yet and you have to abide by certain laws, right. I can't target an American etcetera. Like there's so much interesting shit that that's gotten resolved in that.

And I guess sort of very long winded way of saying when I say I'm an audience of one for certain things, they figured out how to do Co development across teams that would never meet each other from different organizations in different countries. I don't understand how that works. We can't get like people in. We can't do that. Now what? Exactly. It's like, it's like there's, there's, there's, there's like 2 organizations that have solved any of these problems, the Five Eyes orgs and Google and everyone else is fucked. Like everybody else is just rubbing sticks together and like hoping that fire emerges.

So that's part of my fascination with all this stuff is like going back to understand how, how does Reagan and equation, how did they figure out how to, you know, essentially feed everything into infrastructure in a way that's compatible for everybody involved? And like, you know, how do you get the Australians to build a component that's going to work on an an American malware platform that they don't use? And, you know, stuff like that is is just fascinating. Yeah. And even the early offensive operations by early I would say you know like you mentioned 95 like mid 90s. Right.

At that point, the public understood that NSA did code making and code breaking, right? Like and signals intelligence, essentially, they're listening to stuff. They're trying to figure out what that stuff is. And they're also developing cryptosystems to protect our stuff. We didn't think of them as an offensive cyber operator back then. If anybody was thinking about that stuff, we were probably thinking of Langley as doing it or, you know, maybe the military, You know, we didn't have Cyber Command back then, but, you know, Air Force is doing some things and Army was doing some things. But there wasn't like this cohesive strategy because there wasn't a good way to get to remote computers in 1995. Like you couldn't just go attack Russian networks. Really.

Like it wasn't the weight as simple as it is now. So you know. Definitely not directly. There is quite a bit of dial up involved and you. Know there's some satellites, some undersea cables and possibly some people carrying computers across borders. Yeah, yeah. Yeah, well, the things we don't know dwarf the things we know by by an order of magnitude, is my suspicion. As usual, yeah, I I do love this whole cyber paleontology like thing though. Like I, I just love digging into this kind of stuff.

It's so cool. It's an open club. We we encourage members, any members to join you. Know do we have merch yet? Like are there sweatshirts or anything honestly. We should maybe we can put like Vitali's face on some on some T-shirts, right coast in with some coast in aphorisms, right and right with like a chess piece or something. Yeah. And somebody sent me AT shirt that it had the like fast 16 nothing to see here as like Frank Baldwin sent it to me the other day. And I don't know, I, I, I've had that tattooed on me since 2000 and, well, whatever, 19 or whatever, so. What?

Yeah, I've I've had it on me like when we did flame 2 point O like I, I we already have the sample. I was like, I've it's it's been on my arm for seven years. We just didn't know what the fuck it did. We you always missed it. I just didn't know. Yeah, we just didn't know what it did. Yeah. Oh shit, that's cool. I'd love it. I'd love it all right man I've taken up a ton of your time, but this is great. I love going down memory lane and this is just super cool research so I. Appreciate it. I'm happy to talk about this stuff any day you want. All right, well, when we build the the cyber espionage museum, we'll, we'll let the people know where it is.

Maybe it'll be in your, it looks like it could be in your apartment. I don't know. I mean, that would be dope. I'll, I'll, I'll get a cardigan and a pipe and you know, we'll, we'll, we'll lean into it. You've already got the cats watering around, so you're halfway there. All right, Jags. Thanks so much, brother. Great to see you. Thank you so much man, See ya.