Stuxnet has long been treated as the opening act of nation-state cyberwarfare — the moment a piece of code first physically destroyed hardware. But new research from SentinelOne suggests that story needs a rewrite. Analysts have uncovered a previously unknown malware framework called fast16 that predates Stuxnet by several years, with evidence pointing to development as early as 2005.

The malware is built in Lua — an unusual choice that itself hints at a sophisticated, deliberate author — and was designed to target high-precision engineering calculation software. The implication is clear: someone, well before Stuxnet's 2010 discovery, was already writing code intended to corrupt the kind of software used in industrial and scientific processes. The most obvious candidate for a target, given the timeline and the focus on precision engineering tools, is Iran's uranium enrichment programme.

What makes this discovery genuinely significant isn't just the historical footnote. It's what it tells us about the true timeline of offensive cyber capability. Stuxnet's 2010 exposure was treated as a watershed — proof that a cyberweapon could jump the air gap and physically sabotage centrifuges. But if fast16 was operational five years earlier, the development arc of nation-state cyber operations is longer, and likely more advanced, than the public record has ever reflected.

It also raises an uncomfortable question: how many other pre-Stuxnet tools are still sitting in malware repositories, misclassified or unanalysed, waiting for someone to connect the dots? SentinelOne's research suggests that the lineage of ICS-targeted malware — Industroyer, Triton, Pipedream — has roots deeper than the industry has formally documented.

For defenders of operational technology (OT) and industrial control systems (ICS), the research is a useful reminder that the threat model for critical infrastructure has always been longer in the making than the public disclosures suggest. Adversaries invest years in capability development before deployment. The attack you're patching against today was probably designed half a decade ago.

SentinelOne hasn't publicly attributed fast16 to a specific nation-state, which is the right call given the evidence available. Attribution in cyberwarfare is notoriously hard, and the consequences of getting it wrong are serious. But the targeting profile and the technical sophistication point toward a well-resourced state actor with a specific geopolitical interest in slowing Iran's nuclear ambitions — which, in 2005, was a short list.

What to watch: Whether other vendors start re-examining historical malware samples through the lens of this discovery. SentinelOne has essentially published a methodology as much as a finding. Expect follow-on research. Also watch for any Iranian or IAEA response — fast16's existence, if confirmed to have been deployed, represents another chapter in a covert campaign against their nuclear infrastructure that Tehran has rarely acknowledged openly.