In 2018, Israel presented some materials allegedly intended to demonstrate Iran's capabilities for developing nuclear weapons. During that presentation the Israeli PM showed a video of an implosion simulation generated using the LS-DYNA (ls-prepost) software, the same kind of simulation and software targeted by Fast16.
After analyzing the video I found that the uranium core is being compressed to more than double (~2.5x) its density, something objectively beyond Iran's capabilities and the physics of an early stage High Explosives-based implosion mechanism, but that coincidentally matches the Fast16 sabotage.
In this post I elaborate on why I consider this a plausible option by analyzing Fast16 from a cyber-physical perspective, and providing the required verifiable data from reference books and academic publications on the matter.
As usual, the regular disclaimer: what I do is physics-informed reverse engineering, I'm not a physicist. My priority is always to provide accurate and sound technical details on the physics but if you're a nuclear or high-energy physics expert and find something that is objectively wrong, or want to discuss this issue further, please reach out.
Also , If by any chance you, your university, or your company may have a copy of an Autodyn version from around 2005, please reach out.
There is a long read ahead, so let's just begin.
Index
- Introduction and Timeline
- Neutrons and Uranium in a Nutshell
- A Cyber-Physical Analysis of Fast16
- The "Original Iranian Simulation" video
- Conclusions
Introduction and Timeline
On April 23, Vitaly Kamluk and Juan Andrés Guerrero-Saade from SentinelOne Labs published "fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet". Please let me say that this research dropped like a nuclear bomb.
In their post, these experienced malware researchers revealed that they had identified what seemed to be a state-sponsored malware framework intended to sabotage a very specific range of simulations running in certain multi-physics simulation software. In this regard, they initially identified two potential, and plausible targets: Iran's nuclear program and LS-DYNA software.
On April 27, I published "Inside Fast16's Physics Sabotage Engine" providing an initial analysis of how Fast16 was targeting the simulations from a physical perspective. As I mentioned in that post there was an important reference value inside Fast16: 19.0. However, at that moment I could not identify the physical process being targeted so I published the patterns and key values to see if that may ring a bell for someone.
On May 16, Symantec threat hunter team and nuclear physics expert David Albright solved the mystery: "Fast16: Pre-Stuxnet Sabotage Tool Was Built to Subvert Nuclear Weapons Simulations". The physical process Fast16 was targeting (in a simulation) was the compression of a uranium core, which in turn plausibly pointed to simulations of nuclear implosions. For a nuclear expert like David Albright that value of 19.0 was surely a flashing signal, as he explained: "The target metal appears to be uranium. The software lists a value of 19, where 19 g/cc is the density of solid uranium at atmospheric pressure."
Kim Zetter wrote the story behind this discovery: "Experts Confirm the Fast16 Malware Was Sabotaging Nuclear Weapons Tests, Likely in Iran".
Neutrons and Uranium in a Nutshell.
I think it's useful to start this type of analysis by providing a brief technical context for what is going to be discussed later, so everyone, regardless of their technical background, can simply follow along if they're curious, and have the most important elements to dig deeper if they're really interested.
If you are in the latter group, the following may be handy. In 2024 I published "A Practical Analysis of Cyber-Physical Attacks Against Nuclear Reactors", which contains a 45-page practical introduction to nuclear physics in order to get a grasp of fission, neutron interactions with matter, cross-sections, fissile/fissionable isotopes, (super)criticality...and in general terms how and why nuclear power plants work, but also nuclear weapons.
In that paper I summed it up as follows: "For instance, nuclear bombs fundamentally depend on fast fission. So, to compensate for the low probability of fast neutrons causing fission in U-235, HEU (~90%) is used and placed in a very compact volume" but let's unpack it.
In her historic initial explanation of fission, published in Nature in 1939 , Austrian physicist Lisa Meitner wrote:
"It seems therefore possible that the uranium nucleus has only small stability of form, and may, after neutron capture, divide itself into two nuclei of roughly equal size."
So, we have that neutrons and uranium are the main players here.
Natural uranium is mainly comprised of two isotopes: U-235 (0.711%) and U-238 (99.284%). However, they don't interact in the same way with neutrons, and this is defined by their respective microscopic cross-sections, which basically represent the probability of a neutron interacting with a nucleus in a specific manner according to the energy of the neutron. Let's recall that according to its energy, neutrons can basically be divided in fast, for high energy, or thermal, for low energy neutrons.
U-235 is known as the fissile isotope, which means it can sustain a chain reaction if you can induce a fission on it via thermal (slow) neutrons (among other things). However, in a nuclear bomb you want a chain reaction, and you want it really fast, there is no time for moderating (reducing neutrons' energy by forcing them to repeatedly scatter with other nuclei, such as hydrogen from water as in nuclear power plants) a fast neutron to turn it into a thermal neutron. If you are planning to build a nuclear bomb, that's where your problems start. And this is a major issue because the fission cross section of the U-235 reveals that it's rather difficult to cause a fission using fast neutrons (red-highlighted area).
The second problem (of many) is that, as mentioned earlier, natural uranium is mostly U-238, which has a natural tendency to capture neutrons that could otherwise cause fissions. So if you want a nuclear bomb, you need to turn the tables, and make U-235 the dominant isotope. That's what enriching uranium really means, increasing the percentage of the fissile isotope (U-235).
The ability to enrich uranium is what Stuxnet targeted.
The second thing you need to overcome is the difficulty of sustaining a chain reaction using just fast neutrons and U-235, as we have seen it's the least probable option. And the way to achieve that is by concentrating the fissile material (U-235) in the most compact geometry possible, a spherical volume: the uranium core we will see later. By doing this the probability of fast neutrons to find other U-235 nuclei, rather than leaking, is dramatically increased and thus inducing further fissions to sustain a chain reaction is now feasible. But to do that, you must compress the core, thus increasing its density.
The ability to design the compression mechanism of the uranium core is what Fast16 targeted.
Let's see how.
A Cyber-Physical Analysis of Fast16
Fast16 is capable of targeting different simulation software, so far two of them have been identified: LS-DYNA and Autodyn. The execution flow of the target software is hijacked at specific points (hooks), according to a set of rules, which ultimately lead to the main handler. Keeping the naming convention used in Symantec’s research, there are three main mechanisms: A (unknown software), B (LS-DYNA) and C (Autodyn). Therefore, a mechanism is basically a set of hooks, optional subroutines, and a main handler.
These three mechanisms share the same numerical sabotage approach, depicted in the following diagram. In my April analysis, I described it as decoupled from the physical process being targeted, since I could not identify it at that moment. Now that Symantec threat hunter team has resolved this unknown, we can add the proper context to it.
The numerical sabotage calculates a reduction factor based on the current (in simulation time terms) density of the simulation's elements (e.g. a uranium core, which internally can be implemented in different ways), defined as follows:
This resulting reduction factor represents the percentage that will be used to artificially lower a quantity. The three mechanisms use the same approach but there is no certainty as to what this quantity represents, except for mechanism B, which according to Symantec is the Cauchy stress tensor.
By reversing the implementation of mechanism B (targeting LS-DYNA) we can see that Fast16 applies the reduction factor to three values that would represent the diagonal terms of the Cauchy stress tensor (σ_xx, σ_yy, σ_zz), and then updates their previous values with the malicious ones.
So what’s modifying Fast16 then? Essentially pressure. Let’s see why.
Working under pressure
I think it is important to first identify where Fast16 establishes the "camp base" within the computation cycle of its targets (explicit solvers). From its privileged position Fast16 is capable of controlling key calculations during, and after solving the equations of state for the materials present in the simulation.
Basically, Fast16 targets the moment where the solver determines how the material should react to the physical conditions (e.g is the material being compressed, expanded or heated?), which are essentially governed by the conservation of energy and momentum. Therefore, at that point there is a set of thermodynamic properties that must be known, and others that need to be derived to continue with a physically sound simulation of the real world.
This is when the equations of state (EOS) come into play, allowing the solver to determine the state of matter based on key thermodynamic properties such as pressure, volume, temperature or internal energy. It’s not the first time EOS have played a role in sophisticated operations targeting Iran: yes, Stuxnet time...
I already covered this in 2024 (pages 50-52), but I think it comes in handy when trying to get a practical grasp of equations of state. The ideal gas law, the first equation of state ever, is a key concept for understanding how the '417' payload was designed.
In the diagram below we can see the phase diagram of Uranium Hexafluoride (UF6), the main compound used during the uranium enrichment process. At room temperature (~25ºC), a moderate increment in the pressure would cause a change in the phase from ‘Gas’ to ‘Solid’, thus creating deposits of solidified UF6.
During the ‘417’ attack approximately 80% of the total centrifuges were isolated. From the ideal gas law we know that pressure is inversely proportional to volume so it is possible to relate the states before and after the attack was activated.
- Before the attack: P = nRT/V where V can be approximated, for simplicity, as the number of centrifuges times its volume
- After the attack: P’ = nRT/(V’) where V’ is approximately 20% of the total volume as close to 80% of the centrifuges have been isolated.
So according to this equation of state, the resulting pressure once the attack has been activated will be approximately 5 times higher than under regular conditions, which was precisely the setpoint used by Stuxnet, and the pressure at which UF6 will begin to desublimate. To bring this to our context, we can say that the actors behind Stuxnet, likely the same as those behind Fast16, relied on an equation of state to predict how UF6 would react to this pressure change, forced that state and leveraged the solid depositions to physically destabilize the centrifuge rotors.
However, it turns out that accurately predicting how uranium will react to extreme pressure changes is not that easy. Actually, it lies in the area of classified physics, because doing so is a crucial step in developing nuclear weapons. On his Fast16 analysis, David Albright explains it:
“The accuracy of predicted pressures, densities, and phase states becomes increasingly uncertain at high compression because of limitations in available uranium equation-of-state data and the complexity of its phase behavior, leaving the designer more dependent on the model rather than experimental data.“
This is precisely the rationale behind the Fast16 sabotage, as there is an interesting asymmetry here: the actors behind Fast16 already know everything about uranium, unsurprisingly since they have been working in that area since the Manhattan Project. On the other hand, Iran was trying to “catch up” in this area, but having limited information about what to expect...if something does not look right, there is no detailed reference data to compare with. Fast16 exploited that leverage with total precision. Let’s see how.
The sabotage logic of Fast16 has 4 main phases, which we can relate with the video just to get a clear picture, I'm not implying the video represents a simulation tampered by Fast16.
Phase 1
This phase requires identifying an element in the simulation that has a density higher than five times (ρ_t) a reference density initialized from High Explosives (HE) EOS (most probably HE density). This means that Fast16 only activates when the simulation contains an element with a high density material (beyond the maximum density achievable by HE), such as uranium.
When such an element is found, its density (ρ_c) is used to calculate the numerical sabotage parameters as it has been previously introduced. Mechanisms B and C rely on different configuration tables that are used to determine the range of densities for the pass-thru, linear and plateau phases, in addition to the corresponding reduction factor levels. These configuration tables have various entries, probably corresponding to different versions of the targets/simulation objectives.
ρ_s is calculated according to the highest density element in the simulation, which is assumed to be the uranium core (ρ_c, ~19.0 g/cm3).
ρ_c is then multiplied by a very specific hardcoded scaling factor: 1.5789, which is exactly the compression factor 30/19. This means that ρ_s is always expected to be around 30 g/cm3.
Phase 2
In this phase, Fast16 checks whether the core has reached the start density (ρ_s) that marks the beginning of the actual sabotage. If not, it simply implements a pass-through logic, without modifying anything. This means the core has not been compressed enough via the shock wave generated by the multipoint detonation.
Phase 3
When the core has reached the start density (ρ_s), Fast16 starts applying the reduction factor to the pressure-related quantity, such as the Cauchy stress tensor in mechanism B. And this is when the pieces start fitting together perfectly.
In this phase, the uranium core will be around 30 g/cm3, so it has been compressed approximately 1.57 times from its original density (19.0), not an easy task. And it's not a coincidence either. Let's bring back David's analysis one more time:
“The density of 30 g/cc is the point at which the lattice structure of solid uranium is soon to collapse, and the material starts to liquify under shock. A density of 30 g/cc is further assessed to be a compression within reach of an early nuclear implosion weapons program”
I previously mentioned that predicting the state of uranium under extremely high pressures is not easy, not only because of the technical resources required to collect this data experimentally, but also because it becomes classified information beyond a certain point, where the pressures and densities achieved fall into the realm of nuclear weapons rather than purely academic or industrial scope.
So, the problem is how to know whether your equation of state is properly characterizing the behavior of a material? The more extreme the conditions are and the more complex the material is the more complicated it will be to follow a purely analytical approach. Compressing a uranium core via a shock wave is one of those cases.
In that scenario, the EOS (e.g. Mie-Grüneisen) can leverage the collected experimental data in the form of Hugoniot curves, which describe the locus of all possible final states a material can reach via shock compression.
However, coincidentally, passing the barrier of 30 g/cm3 with extreme pressures already over 2.5 MBar, uranium becomes an even more complex material and the publicly available Hugoniot curves decay (pun intended). We can clearly visualize this situation in the available academic publications.
It does not seem a coincidence that Fast16 targets the density ranges beyond 30 g/cm³, but rather a deliberate approach to frustrate Iranian scientists while hiding the numerical sabotage in a difficult analytical area with limited tabulated data for comparison.
To accomplish the task Fast16 had to come up with a sound but subtle way to sabotage the physical world, even in a simulation. You can’t just modify arbitrary values and expect the solver to converge to a solution without triggering a plethora of warnings and errors that could put the simulation team on alert.
In the Cauchy stress tensor (𝛔) approach documented by Symantec, Fast16 is modifying only the volumetric part (no shear stress part as uranium is now basically a fluid), which comes from pressure calculated by the EOS (𝛔 = -PI). But Fast16 is careful enough not to change the EOS pressure itself, but instead to directly modify the diagonal terms, which represent a much more limited and targeted modification. So, essentially, the core becomes overcompressed because, instead of becoming harder to compress as its density increases, it becomes unphysically soft.
In an explicit solver, the computation cycle we saw previously is performed repeatedly over infinitesimal time steps, where each previous cycle influences the following one. And Fast16 gradually corrupts specific values. So, I think the calculated slope helps make the sabotage not only smoother, but also might help prevent numerical solutions from drifting beyond a certain range. This is important because subtly modifying pressure-related values is clever, but in the end you are still breaking the conservation of momentum and energy.
The following can be found in the theory manual from Autodyn 2005:
Phase 4
Beyond the end density (ρ_e), Fast16 applies a static reduction factor. The interesting part is that the end densities configured in Fast16 are extremely high: 40 g/cm³, 47 g/cm³, 48 g/cm³, or even absurdly high at 60 g/cm³. Initially, one might think that those densities are just there to calculate the slope and won't be achieved. Under normal circumstances, Iran had never expected to reach that level of compression, as David Albright points out in his analysis:
“If Iran was the target, Iran’s nuclear weapons program would have had a hard time doubling the core density in 2005, likely also today. Achieving such high densities in uranium poses several challenges in a single HE-flyer plate-solid core system. Moreover, in 2003, Iran was looking to achieve only an explosive yield of 10 kilotons, further suggesting that the nuclear weapons team was not working to achieve such high densities. This would suggest that the actual densities being achieved were less than double and closer to 31 or 33 grams per cc, close to the activation density of the malware and after the solid would undergo a phase change to a liquid.”
However, Iran somehow managed to do it (perhaps with the “help” of Fast16?), since the simulation video presented by the Israeli Prime Minister shows the core reaching ~47 g/cm³, a compression factor of ~2.5, more than double its original density...
The "Original Iranian Simulation" video
First of all, the software used to generate the video is, coincidentally, LS-DYNA (ls-prepost) and according to the visual characteristics, and certain information, its date is plausibly within the years where Fast16 was active, or close to it.
One of the first things I did after finding the video was to measure the radius of the core at the beginning and at the end of the simulation, to calculate the compression rate achieved.
As we know that the density at the beginning is 19.0 g/cm³ (ρ_o), we can calculate the final density (ρ) by multiplying it by the compression ratio: ~2.5. Coincidentally, the resulting density is ~47 g/cm³, which matches with some of the target densities that can be found in Fast16's configuration tables, as documented both by Symantec's research and my own April analysis.
The video shows a simulation of a multipoint detonation in a confined space, apparently intended to compress an uranium core. Based on how the shock wave propagates, converges and interacts with the core, I think there are three elements: the core, a tamper around it of unknown material, and a high explosives layer. Essentially, a design similar to the Fat-Man nuclear bomb.
In fact, in the video we can observe every single problem historical physicists from the Manhattan Project faced, which were documented in the reference book "The Making of the Atomic Bomb": the triple points, the Raleigh-Taylor/Richtmyer–Meshkov instabilities...
Despite all these problems, the simulation somehow achieves better compression results than fully-developed nuclear weapons.
In fact, for achieving a 2.5x compression factor, the pressure should be, in the most optimistic case, above the range of 20 MBar, which seems totally unrealistic for the initial stage of high explosives-based multipoint detonation.
So, the obvious next step was to figure out whether the video could realistically be a simulation sabotaged by Fast16. So I mapped each frame in the video to the density range where Fast16 becomes active .
Please note that I consider that this hydrodynamics simulation is depicting pressure. However, it wouldn't fundamentally change the analysis if it were depicting density or internal energy instead, as they are closely related via the Rankine-Hugoniot equations.
Interestingly, as one would expect from the Fast16 linear phase, the pressure progressively decreases even as the core continues to compress, at a stage where the pressure should be at astronomical levels due to the opposition of the core to being compressed. Finally, we can see a pressure peak consistent with the stagnation phase.
Conclusions
Honestly, deciding whether this video shows Fast16 in action or it is a physically expected result of the complexity of uranium at those pressures and densities is not something I am qualified to answer.
That said, I think there is enough evidence to seriously consider the first option.
If you are reading this and have the required background to seriously address this question, I would be interested in discussing it further. Please feel free to reach out.