Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Trigger”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 685 records · Page 38

Investigating strangeness enhancement with multiplicity in pp collisions using angular correlations

A study of strange hadron production associated with hard scattering processes and with the underlying event is conducted to investigate the origin of the enhanced production of strange hadrons in small collision systems characterised by large charged-particle multiplicities. For this purpose, the production of the single-strange meson ${\textrm{K}}_{\textrm{S}}^0$ and the double-strange baryon Ξ ± is measured, in each event, in the azimuthal direction of the highest-p T particle (“trigger” particle), related to hard scattering processes, and in the direction transverse to it in azimuth, associated with the underlying event, in pp collisions at $\sqrt{s}$ = 5.02 TeV and $\sqrt{s}$ = 13 TeV using the ALICE detector at the LHC. The per-trigger yields of ${\textrm{K}}_{\textrm{S}}^0$ and Ξ ± are dominated by the transverse-to-leading production (i.e., in the direction transverse to the trigger particle), whose contribution relative to the toward-leading production is observed to increase with the event charged-particle multiplicity. The transverse-to-leading and the toward-leading Ξ ± /${\textrm{K}}_{\textrm{S}}^0$ yield ratios increase with the multiplicity of charged particles, suggesting that strangeness enhancement with multiplicity is associated with both hard scattering processes and the underlying event. The relative production of Ξ ± with respect to ${\textrm{K}}_{\textrm{S}}^0$ is higher in transverse-to-leading processes over the whole multiplicity interval covered by the measurement. The ${\textrm{K}}_{\textrm{S}}^0$ and Ξ ± per-trigger yields and yield ratios are compared with predictions of three different phenomenological models, namely Pythia8.2 with the Monash tune, Pythia8.2 with ropes and EPOS LHC. The comparison shows that none of them can quantitatively describe either the transverse-to-leading or the toward-leading yields of ${\textrm{K}}_{\textrm{S}}^0$ and Ξ ± .

hadron-hadron scattering↗

Generating Buoyancy-Driven Convection in Membrane Distillation

Membrane distillation (MD) is a thermally-driven desalination process that can treat hypersaline brines. Considerable MD literature has focused on mitigating temperature and concentration polarization. This literature largely neglects that temperature and concentration polarization increase the feed density near the membrane. With gravity properly oriented, this increase in density could trigger buoyancy-driven convection and increase permeate production. Convection could also be strengthened by heating the feed channel wall opposite the membrane. To investigate that possibility, we perform a series of experiments using a plate-and-frame direct contact MD system with an active membrane area of 300 cm2 and a feed channel wall heated using a resistive heater. The experiments measure the average transmembrane permeate flux for two gravitational orientations, feed Reynolds numbers between 128 and 1128, and wall heat fluxes up to 12 kW/m2. The results confirm that with gravity properly oriented, wall-heating can trigger buoyancy-driven convection for a wide range of feed Reynolds numbers, and increase permeate production between roughly 20 and 130 %. We estimate, however, that at high Reynolds numbers (Re > 800), more than 70 % of the wall heat is carried out of the MD system by the feed flow, without contributing to permeate production. This suggests the need for longer membranes and heat recovery steps in any future practical implementation.

buoyancy-driven convection↗

DUNE DAQ R&D integration in ProtoDUNE Single-Phase at CERN

The DAQ system of ProtoDUNE-SP successfully proved its design principles and met the requirements of the beam run of 2018. The technical design of the DAQ system for the DUNE experiment has major differences compared to the prototype due to different requirements placed on the detector, as well as a radically different location of operation. The single-phase prototype at CERN is a major integration facility for R&D aspects of the DUNE DAQ system. The facility allows for the exploration of additional data processing capabilities and optimization of the FELIX system, which is the chosen TPC readout solution for the DUNE single-phase detectors. One of the fundamental differences from the prototype is that the DUNE DAQ relies on self-triggering. Therefore, real-time processing of the data stream for hit and trigger primitive finding is essential for the requirement of continuous readout. The supernova burst trigger requires a large and fast buffering technique, where 3D XPoint persistent memory solutions are evaluated and integrated. In order to maximize resource utilization of the FELIX hosting servers, the elimination of the 100 Gb network communication stack is desired. This implies the design and development of a single-host application layer, which is a fundamental element of the self-triggering chain. This paper discusses the evaluation and integration of these developments for the DUNE DAQ, in the ProtoDUNE environment.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

The Phase-2 Upgrade of the CMS Data Acquisition

The High Luminosity LHC (HL-LHC) will start operating in 2027 after the third Long Shutdown (LS3), and is designed to provide an ultimate instantaneous luminosity of 7:5 × 10$^{34}$ cm$^{-2}$ s$^{-1}$, at the price of extreme pileup of up to 200 interactions per crossing. The number of overlapping interactions in HL-LHC collisions, their density, and the resulting intense radiation environment, warrant an almost complete upgrade of the CMS detector. The upgraded CMS detector will be read out by approximately fifty thousand highspeed front-end optical links at an unprecedented data rate of up to 80 Tb/s, for an average expected total event size of approximately 8 - 10 MB. Following the present established design, the CMS trigger and data acquisition system will continue to feature two trigger levels, with only one synchronous hardware-based Level-1 Trigger (L1), consisting of custom electronic boards and operating on dedicated data streams, and a second level, the High Level Trigger (HLT), using software algorithms running asynchronously on standard processors and making use of the full detector data to select events for offline storage and analysis. The upgraded CMS data acquisition system will collect data fragments for Level-1 accepted events from the detector back-end modules at a rate up to 750 kHz, aggregate fragments corresponding to individual Level- 1 accepts into events, and distribute them to the HLT processors where they will be filtered further. Events accepted by the HLT will be stored permanently at a rate of up to 7.5 kHz. This paper describes the baseline design of the DAQ and HLT systems for the Phase-2 of CMS.

Badaro, Gilbert↗

A field programmable gate array-based timing and control system for the dynamic compression sector

A field programmable gate array (FPGA)-based timing and trigger control system has been developed for the Dynamic Compression Sector (DCS) user facility located at the Advanced Photon Source (APS) at Argonne National Laboratory. The DCS is a first-of-its-kind capability dedicated to dynamic compression science. All components of the DCS laser shock station—x-ray choppers, single-shot shutter, internal laser triggers, and shot diagnostics—must be synchronized with respect to the arrival of x rays in the hutch. An FPGA synchronized to the APS storage ring radio frequency clock (352 MHz) generates trigger signals for each stage of the laser and x-ray shutter system with low jitter. The developed FPGA-based control system was the first system used to control the laser and the shutter system since its commissioning, and it has been developing since then to improve the timing jitter. The system is composed of a Zynq FPGA, a debug card, line drivers, and a power supply. The delay and offsets of the trigger signals can be adjusted by using a user-friendly graphical user interface with high precision. Here, the details of the system architecture, timing requirements, firmware, and software implementation along with the performance evaluation are presented in this paper. The system offers low timing jitter (15.5 ps rms) with respect to the APS 352 MHz clock, suitable for the 100 ps (FWHM) x-ray bunch duration at the APS.

47 OTHER INSTRUMENTATION↗

Effect of bars on evolution of SDSS spiral galaxies

ABSTRACT We explore the significance of bars in triggering central star formation (SF) and active galactic nucleus (AGN) activity for spiral galaxy evolution using a volume-limited sample with 0.020 < z < 0.055, Mr < −19.5, and σ > 70 km s−1 selected from Sloan Digital Sky Survey Data Release 7. On a central SF rate–σ plane, we measure the fraction of galaxies with strong bars in our sample and also the AGN fractions for barred and non-barred galaxies, respectively. The comparison between the bar and AGN fractions reveals a causal connection between the two phenomena of SF quenching and AGN activity. A massive black hole and abundant gas fuels are sufficient conditions to trigger AGNs. We infer that the AGNs triggered by satisfying the two conditions drive the strong AGN feedback, suddenly suppressing the central SF and leaving the SF sequence. We find that in galaxies where either of the two conditions is not sufficient, bars are a great help for the AGN triggering, accelerating the entire process of evolution, which is particularly evident in pseudo-bulge galaxies. All of our findings are obtained only when plotted in terms of their central velocity dispersion and central SFR (not galactic scale SFR), indicating that the AGN-driven SF quenching is confined in the central kpc region.

Kim, Minbae↗

Investigating strangeness enhancement in jet and medium via 𝜙⁡(1020) production in 𝑝-Pb collisions at √ s NN = 5.02TeV

This work aims to differentiate strangeness produced from hard processes (jetlike) and softer processes (underlying event) by measuring the angular correlation between a high-momentum trigger hadron (ℎ) acting as a jet proxy and a produced strange hadron [𝜙⁡(1020) meson]. Measuring ℎ−𝜙 correlations at midrapidity in 𝑝-Pb collisions at √ s NN = 5.02TeV as a function of event multiplicity provides insight into the microscopic origin of strangeness enhancement in small collision systems. The jetlike and the underlying-event-like strangeness production are investigated as a function of event multiplicity. They are also compared between a lower and higher momentum region. The evolutions of the per-trigger yields within the near-side (aligned with the trigger hadron) and away-side (in the opposite direction of the trigger hadron) jets are studied separately, allowing for the characterization of two distinct jetlike production regimes. Furthermore, the ℎ−𝜙 correlations within the underlying event give access to a production regime dominated by soft production processes, which can be compared directly to the in-jet production. Comparisons between ℎ−𝜙 and dihadron correlations show that the observed strangeness enhancement is largely driven by the underlying event, where the 𝜙/ℎ ratio is significantly larger than within the jet regions. As multiplicity increases, the fraction of the total 𝜙⁡(1020) yield coming from jets decreases compared to the underlying event production, leading to high-multiplicity events being dominated by the increased strangeness production from the underlying event.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

Search for a Narrow Resonance Lighter than 200 GeV Decaying to a Pair of Muons in Proton-Proton Collisions at $\sqrt{s} =$ TeV

A search is presented for a narrow resonance decaying to a pair of oppositely charged muons using s=13 TeV proton-proton collision data recorded at the LHC. In the 45–75 and 110–200 GeV resonance mass ranges, the search is based on conventional triggering and event reconstruction techniques. In the 11.5–45 GeV mass range, the search uses data collected with dimuon triggers with low transverse momentum thresholds, recorded at high rate by storing a reduced amount of trigger-level information. The data correspond to integrated luminosities of 137 and 96.6 fb-1 for conventional and high-rate triggering, respectively. No significant resonant peaks are observed in the probed mass ranges. The search sets the most stringent constraints to date on a dark photon in the ∼30–75 and 110–200 GeV mass ranges.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

Study of the Heater-Coil Electrical Insulation for the HL-LHC Low Beta Quadrupoles

In the framework of the HL-LHC project, the present LHC low-β superconducting quadrupoles will be substituted with higher performance Nb 3 Sn magnets (MQXF) with 11.4 T coil peak field. MQXF coils are impregnated with epoxy resin to reduce risk of stress concentration on the brittle conductor. The magnet quench protection is provided by CLIQ and quench heaters to ensure a redundant system. Quench heaters are impregnated with the coils in order to have suitable thermal contact with them, and to prevent the hot spot temperature from exceeding 350K during normal operation in case of a quench. Quench heaters are insulated from the coil by S-2 Glass and polyimide. Here, the test of the first MQXF prototype (4 m long) MQXFAP1 was stopped by a coil-to-ground short circuit triggered by a heater-to-coil short. This issue triggered a root analysis of the causes of this short. Here we prove that the use of a non-conforming cloth in coil impregnation, further weakened by non-conforming high voltage test, has triggered the shorts. Moreover, we present an analysis of the heater-to-coil insulation strength, showing the role of blistering phenomena and how they are triggered by a combination of magnet powering and heater firing.

43 PARTICLE ACCELERATORS↗

Monsoonal MCS Initiation, Rainfall, and Diurnal Gravity Waves over the Bay of Bengal: Observation and a Linear Model

Abstract Previous observational studies have indicated that mesoscale convective systems (MCSs) contribute the majority of precipitation over the Bay of Bengal (BoB) during the summer monsoon season, yet their initiation and propagation remain incompletely understood. To fill this knowledge gap, we conducted a comprehensive study using a combination of 20-yr satellite observations, MCS tracking, reanalysis data, and a theoretical linear model. Satellite observations reveal clear diurnal propagation signals of MCS initiation frequency and rainfall from the west coast of the BoB toward the central BoB, with the MCS rainfall propagating slightly slower than the MCS initiation frequency. Global reanalysis data indicate a strong association between the offshore-propagating MCS initiation frequency/rainfall and diurnal low-level wind perturbations, implying the potential role of gravity waves. To verify the hypothesis, we developed a 2D linear model that can be driven by realistic meteorological fields from reanalysis. The linear model realistically reproduces the characteristics of offshore-propagating diurnal wind perturbations. The wind perturbations, as well as the offshore propagation signals of MCS initiation frequency and rainfall, are associated with diurnal gravity waves emitted from the coastal regions, which in turn are caused by the diurnal land–sea thermal contrast. The ambient wind speed and vertical wind shear play crucial roles in modulating the timing, propagation, and amplitude of diurnal gravity waves. Using the linear model and satellite observations, we further show that the stronger monsoonal flows lead to faster offshore propagation of diurnal gravity waves, which subsequently control the offshore propagation signals of MCS initiation and rainfall. Significance Statement Rainfall over the Bay of Bengal (BoB) is primarily contributed by large and organized rainfall systems in the summer monsoon season. During this season, these systems are commonly observed over the east coast of India around midnight, the western BoB in the morning, and the central BoB in the afternoon. This eastward rainfall propagation is confirmed by observations, reanalysis data, and a theoretical model to have a strong association with atmospheric diurnal gravity waves. These waves are caused by land–sea thermal contrast and can trigger rainfall systems over the offshore regions. We also found that the diurnal gravity waves, as well as their triggered rainfall systems, can be greatly modulated by the large-scale monsoonal flows. All the above findings improve our understanding of diurnal rainfall cycle over the BoB and may contribute to the future improvement of rainfall forecast over the region.

Meteorology & Atmospheric Sciences↗

Tornadoes in Southeast South America: Mesoscale to Planetary-Scale Environments

Abstract A multiscale analysis of the environment supporting tornadoes in southeast South America (SESA) was conducted based on a self-constructed database of 74 reports. Composites of environmental and convective parameters from ERA5 were generated relative to tornado events. The distribution of the reported tornadoes maximizes over the Argentine plains, while events are rare close to the Andes and south of Sierras de Córdoba. Events are relatively common in all seasons except in winter. Proximity environment evolution shows enhanced instability, deep-layer vertical wind shear, storm-relative helicity, reduced convective inhibition, and a lowered lifting condensation level before or during the development of tornadic storms in SESA. No consistent signal in low-level wind shear is seen during tornado occurrence. However, a curved hodograph with counterclockwise rotation is present. The Significant Tornado Parameter (STP) is also maximized prior to tornadogenesis, most strongly associated with enhanced CAPE. Differences in the convective environment between tornadoes in SESA and the U.S. Great Plains are discussed. On the synoptic scale, tornado events are associated with a strong anomalous trough crossing the southern Andes that triggers lee cyclogenesis, subsequently enhancing the South American low-level jet (SALLJ) that increases moisture advection to support deep convection. This synoptic trough also enhances vertical shear that, along with enhanced instability, sustains organized convection capable of producing tornadic storms. At planetary scales, the tornadic environment is modulated by Rossby wave trains that appear to be forced by convection near northern Australia. Madden–Julian oscillation phase 3 preferentially occurs 1–2 weeks ahead of tornado occurrence. Significance Statement The main goal of this study is to describe what atmospheric conditions (from local to global scales) are present prior to and during tornadic storms impacting southeast South America (SESA). Increasing potential for deep convection, wind shear, and potential for rotating updrafts, as well as reducing convective inhibition and cloud-base height, are predominant a few hours before and during the events in connection to low-level northerly winds enhancing moisture transport to the region. Remote convective activity near northern Australia appears to influence large-scale atmospheric circulation that subsequently triggers convective storms supporting tornadogenesis 1–2 weeks later in SESA. Our findings highlight the importance of accounting for atmospheric processes occurring at different scales to understand and predict tornado occurrences.

Meteorology & Atmospheric Sciences↗

An Indirect Search for Weakly Interacting Massive Particles in the Sun Using Upward-going Muons in NOvA

I present the first Dark Matter search results using the full data set collected with the upward-going muon trigger in NOvA. Weakly Interactive Massive Particles (WIMPs) are a theoretical non-baryonic form of Dark Matter. The nature of Dark Matter is one of the most exciting open questions in modern physics. Though its existence can be inferred by astrophysical evidence, its properties are not yet understood. If we assume that Dark Matter particles can produce Standard Model particles through their interactions, an indirect search can help shed light on this mystery.The NOvA collaboration has built a 14 kton, fine-grained, low-Z, total absorption tracking calorimeter at an off-axis angle to the NuMI neutrino beam. Even though the detector is optimized to observe electron neutrino appearance from a muon neutrino beam, it has a unique potential for more exotic searches given its excellent granularity and energy resolution and relatively low-energy neutrino thresholds. In fact, with an efficient upward-going muon trigger and sufficient background suppression offline, NOvA is capable of a competitive indirect Dark Matter search for low-mass WIMPs.The idea of the upward-going muon trigger is first to select high-quality muon tracks, then use the timing information of all of the hits of each track to estimate directionality. In this way, the background flux is suppressed by more than a factor of 10^5 at trigger level to a rate of approximately 1 Hz. To further optimize this search, we use only upward-going muons that point to the Sun, so our search occurs at night when the Sun is on the other side of the Earth. This strategy also allows us to use the time when the Sun is above the horizon as a control region to estimate the background. Ultimately, implementation of a cut based and maximum likelihood analysis provides a powerful tool for rejecting background and selecting a sample of neutrino-induced upward-going muons. The overall background rejection power achieved by the analysis is substantial and impressive. Starting with approximately 150,000 events per second, we reduced it to 40 events per year. Since no statistically significant excess was found, a 90\% C.L. upper limit on the expected muon flux of upward-going muons has been set using the upper limit on the number of events given the number of observed events in the signal region. Lastly, by assuming the theory behind the upward-going muon flux, a limit on the WIMP-nucleon spin-dependent cross-section in the Sun was estimated. Although the limits on the spin-dependent cross-section do not appear to be competitive with previous indirect Dark Matter searches, the upward-going muon flux limits are promising. The upward-going muon flux limits could extend these results to a broader class of models that are not specific to the dark matter theory but produce upward-going muons, leading to competitive results.

Principato, Cristiana↗

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗