Looking at the data for both items.
Item 1: APT28 Campaign Targeting NATO Military Organizations
Timeline: Recon began March 2024, with confirmed compromises running through March 2026 — a 24+ month campaign. The targeting spans military and government institutions in Greece, Romania, Bulgaria, and Ukraine, focused on NATO's eastern flank.
The TOTP seed exfiltration is significant. Rather than simple session hijacking, extracting the actual seed values allows offline code generation — a more surgical approach than typical MFA bypass I've tracked from this group. The campaign employed email forwarding rules against Hellenic National Defense General Staff accounts, including military attachés in India and Bosnia.
Operational cluster overlap: This aligns with APT28's (G0016) established victimology. The FrostArmada router campaign showed identical NATO military/government targeting patterns and multi-year timeline structure — that is the same tradecraft cluster I'm tracking. The German BfV warning from April 2026 about TP-Link router compromises targeting German parliament, SPD, and air traffic control reinforces this pattern. PRISMEX malware targeting Ukrainian defense supply chains across Poland, Romania, and Slovakia shows the same sustained focus on Central/Eastern European military infrastructure.
Assessment (high confidence): This matches APT28's operational pattern. The TOTP seed exfiltration represents genuine TTP evolution — refinement beyond typical MFA bypass, leveraging access to 2FA seed storage or QR codes during enrollment.
Item 2: Fast16 Malware
The fast16.sys kernel driver has a compilation timestamp of 2005-07-19 15:15:41 UTC, predating Stuxnet by roughly 4-5 years. The malware combines a Lua-based carrier module, a kernel-level filesystem driver, and rule-based code patching — SentinelOne notes this was the first known Windows malware embedding a Lua VM.
The malware targeted engineering simulation software including LS-DYNA 970 (crash simulation) and PKPM (structural engineering). The PDB path visible in samples shows C:\buildy\driver\fd\i386\fast16.pdb.
According to the Territorial Dispute tool from the Shadow Brokers "Lost in Translation" leak (2017), fast16 carried the instruction "NOTHING TO SEE HERE—CARRY ON." This is an NSA deconfliction signature indicating the operation belonged to NSA, allied intelligence, or Five Eyes partners — telling NSA operators not to interfere.
Symantec researchers have now confirmed the malware's purpose: sabotaging nuclear weapons testing simulations by injecting false pressure data into uranium core calculations. The 2005 timing aligns with peak US-Iran tensions over Iran's nuclear program.
Assessment (high confidence on dating, moderate-to-high on targeting): The nuclear weapons targeting claim has strong technical support from SentinelOne's reverse engineering and Symantec's confirmation. The uranium core simulation targeting is specific and documented. Attribution to US/Israel/allies rests on the Territorial Dispute deconfliction signature — reliable but indirect evidence. This reframes the pre-Stuxnet timeline significantly, demonstrating nation-state cyber-sabotage of nuclear infrastructure existed nearly five years before public acknowledgment.