Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “operating experience”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 757 records · Page 42
All sourcesNASA NTRSDOE OSTI
DOE OSTI2026

Industrial Assessment Center Technical Field Manager

The work to be performed involves managing Industrial Assessment Centers through a portfolio of activities. The core activities to be performed are in the general areas of; quality assurance of IAC operations, enhancement of the student IAC experience, program development for improving assessments and implementing smart manufacturing projects, program outreach to carry assessment successes beyond the program, and program integration with other DOE/manufacturing assistance programs. The IAC Technical Field Management Organization (FMO) works in close collaboration with DOE and provides technical management for the IAC program working under policy guidelines established by DOE.

42 ENGINEERING↗
DOE OSTI2020

Operational, gauge-free quantum tomography

As increasingly impressive quantum information processors are realized in laboratories around the world, robust and reliable characterization of these devices is now more urgent than ever. These diagnostics can take many forms, but one of the most popular categories is tomography, where an underlying parameterized model is proposed for a device and inferred by experiments. Here, we introduce and implement efficient operational tomography, which uses experimental observables as these model parameters. This addresses a problem of ambiguity in representation that arises in current tomographic approaches (the gauge problem). Solving the gauge problem enables us to efficiently implement operational tomography in a Bayesian framework computationally, and hence gives us a natural way to include prior information and discuss uncertainty in fit parameters. We demonstrate this new tomography in a variety of different experimentally-relevant scenarios, including standard process tomography, Ramsey interferometry, randomized benchmarking, and gate set tomography.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2021

Mixed Acid Fermentation of Carbohydrate-Rich Dairy Manure Hydrolysate

Dairy manure (DM) is an abundant agricultural residue that is largely composed of lignocellulosic biomass. The aim of this study was to investigate if carbon derived from DM fibers can be recovered as medium-chain fatty acids (MCFAs), which are mixed culture fermentation products of economic interest. DM fibers were subjected to combinations of physical, enzymatic, chemical, and thermochemical pretreatments to evaluate the possibility of producing carbohydrate-rich hydrolysates suitable for microbial fermentation by mixed cultures. Among the pretreatments tested, decrystalization dilute acid pretreatment (DCDA) produced the highest concentrations of glucose and xylose, and was selected for further experiments. Bioreactors fed DCDA hydrolysate were operated. Acetic acid and butyric acid comprised the majority of end products during operation of the bioreactors. MCFAs were transiently produced at a maximum concentration of 0.17 mg COD MCFAs /mg COD Total . Analyses of the microbial communities in the bioreactors suggest that lactic acid bacteria, Megasphaera , and Caproiciproducens were involved in MCFA and C4 production during DCDA hydrolysate metabolism.

09 BIOMASS FUELS↗
DOE OSTI2024

DEM, DSM, and Cleaned LiDAR Point Cloud Data from the NGEE Arctic UAS Campaigns at the Teller 27 Field Site from 2017 and 2018, Seward Peninsula, Alaska

A Digital Elevation Model (DEM) and Digital Surface Model (DSM) were derived from airborne Light Detection and Ranging (LiDAR) data collected from Los Alamos National Laboratory's (LANL) heavy-lift unoccupied aerial system (UAS) quadcopter and hexacopter platforms operated by Next-Generation Ecosystem Experiments: Arctic (NGEE Arctic) scientists from the EES-14 group at LANL. These data were collected in August 2017 and July 2018 at the NGEE Arctic field site near mile marker 27 of the Bob Blodgett Nome-Teller Memorial Highway between Nome, Alaska and Teller, Alaska. A Vulcan Raven X8 Airframe (Mitcheldean, Gloucestershire, UK), DJI Matrice 600 Pro Airframe (Shenzhen, China), and Routescene UAV LiDARSystem (Edinburgh, Scotland, UK) were used to collect LiDAR data. Following pre-processing in Routescene LidarViewer Pro software, the LiDAR point clouds were cleaned and processed using CloudCompare software to separate ground and off-ground points. A high resolution DEM and DSM were then created using ArcGIS Pro software. This data package contains fully cleaned point clouds of ground and off-ground points (.las), a 25 cm DEM (.tif), and a 25 cm DSM (.tif) for the Teller 27 field site. Ancillary aircraft data, flight mission parameters, weather conditions, and raw lidar data and imagery can be found in the L0 datasets for these campaigns: NGA299 (2017) and NGA297 (2018). Minimally processed point clouds and auxiliary files can be found in the L1 dataset: NGA304 (2017 and 2018).The Next-Generation Ecosystem Experiments: Arctic (NGEE Arctic), was a 15-year research effort (2012-2027) to reduce uncertainty in Earth System Models by developing a predictive understanding of carbon-rich Arctic ecosystems and feedbacks to climate. NGEE Arctic was supported by the Department of Energy's Office of Biological and Environmental Research.The NGEE Arctic project had two field research sites: 1) located within the Arctic polygonal tundra coastal region on the Barrow Environmental Observatory (BEO) and the North Slope near Utqiagvik (Barrow), Alaska and 2) multiple areas on the discontinuous permafrost region of the Seward Peninsula north of Nome, Alaska.Through observations, experiments, and synthesis with existing datasets, NGEE Arctic provided an enhanced knowledge base for multi-scale modeling and contributed to improved process representation at global pan-Arctic scales within the Department of Energy's Earth system Model (the Energy Exascale Earth System Model, or E3SM), and specifically within the E3SM Land Model component (ELM).

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2025

BOPTEST as a Platform for Building Controls and Grid-Interactive Buildings Workforce Training

Building automation and controls are becoming increasingly complex with the emergence of Grid Integrated Efficient Buildings (GEBs) as well as new highly efficient sequences of operation and data-driven control schemes. However, there remains a significant gap in hands-on training opportunities for building operators and technicians to gain practical experience with advanced control systems in a low-risk environment. This paper presents BOPTEST (Building Optimization Performance Test) as a suitable platform for workforce training in building controls and GEB technologies. BOPTEST provides a suite of standardized building simulation test cases with a REST API, real-time control interfaces through BACnet, semantic models connecting users to building data, and built-in calculation of control metrics and performance indicators. The platform enables trainees to interact with virtual buildings using industry-standard protocols while learning how to implement and innovate control strategies. The training platform is designed to offer a structured and interactive learning experience for building engineers, helping them effectively develop, learn, and retain skills in fault identification, troubleshooting, and correction. The workflow is divided into three main phases: 1) Setup, 2) Exercise, and 3) Review, each comprising specific activities performed by either the instructor or the student. Initial pilot training sessions have yielded positive feedback from instructors and participants and demonstrates that BOPTEST effectively fills an industry need for a low-risk training resource via simulation of real building control systems, allowing trainees to gain practical experience before working in the field. The platform's ability to provide immediate performance feedback while maintaining familiar industry interfaces makes it particularly suitable for workforce development programs. This work provides a replicable model for leveraging building simulation in control education and training.

Paul, Lazlo↗
DOE OSTI2022

Experiment Assembly and Testing in Hot Cell in Support of Advanced Fuels Irradiation Testing

Follow-on experimentation of irradiated nuclear fuel is critical to understanding fuel behavior at different stages of the fuel lifecycle. Transient experiments using fuel with high burnup can enlarge understanding of fuel fragmentation, relocation and dispersal under various reactor accident situations. Assembling experiments with such fuel requires remote operations.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2023

GRAPHITE–MOLTEN SALT CONSIDERATIONS FOR COMPONENTS IN NUCLEAR APPLICATIONS

The new High Temperature Reactor (HTR) designs being considered for future Gen IV nuclear reactor deployment include designs utilizing molten salt as the primary coolant. These molten-salt cooled, graphite core designs pose new material compatibility challenges that are not considered within the gas-cooled HTR designs that have been previously built and operated. While the Molten Salt Reactor Experiment (MSRE) demonstrated that the molten salt can be considered chemically inert to graphite the novel physical and thermal interactions that the molten salt poses may be just as impactful as the chemical reactivity. Specifically, molten salt intrusion into the open pore structure of nuclear graphite grades can provide additional internal stresses within the microstructure exacerbating the stress buildup from irradiation induced dimensional change. Additionally, designs using a molten salt containing liquid fuel could provide “hot spots” within graphite structural components causing local thermal stresses. Abrasion and erosion concerns are magnified with molten salt due to the extremely high density of the salts (some have higher densities than the structural graphite components). Finally, the graphite-graphite and fuel pebble-graphite tribological behavior are distinctly difference within the molten salt from the inert gas environments and must be investigated. These topics and others are currently under investigation within the DOE Advanced Reactor Technologies (ART) graphite program and will be discussed in depth.

Gallego, Nidia↗
DOE OSTI2024

Defect Thermodynamics and Transport Properties of Perovskite and Fluorite Materials for Solid-Oxide and Proton Conducting Oxide Cells Evaluated Based on Density Functional Theory Modeling

Density functional theory based defect thermodynamic modeling was performed to determine the effect of humidity and H2/O2 gas pressure on various defect chemistry and transport properties of perovskite and fluorite oxides for solid-oxide and proton-conducting-oxide cell applications, with inclusion of the electronic-conducting oxides (as electrodes) and insulating oxides (as electrolytes). Automatic defect generation workflow and first-principles charged defect analysis were implemented on NETL Joule supercomputer for modeling defect equilibria and transport properties of insulating oxides as electrolytes in SOCs and proton-conducting ceramic cells. A GNU Octave defect model subroutines were developed to facilitate defect modeling of electronic conducting oxides in a wide range of operating conditions guided by modeling and experiments. The model includes the hydride defect formation reaction under reducing conditions and allows to incorporate nonstoichiometry effects on the defect thermodynamic parameters. The developed model serves as a platform to facilitate fundamental understanding of the defect thermodynamics in SOC oxide materials and can be used as a novel tool in computational materials screening for SOC and other energy applications.

Lee, Yueh-Lin↗
DOE OSTI2025

Mechanical Actuation Mechanism Design for Cryogenic Microwave Cavities in Axion Dark Matter Searches

Resonant Microwave Cavities are placed in a strong magnetic field at cryogenic temperatures (~.1K) in order to try to convert axions into detectable photons. A major challenge is to tune the cavity to allow no interference with the desired environment used for the experiment, which enables the system to operate near absolute zero and maintain superconductivity, thereby reducing noise as much as possible. My project focuses on developing and testing a low-thermal-conductivity gear reduction system with a 1000:1 ratio for cavity tuning. This gear system could significantly improve the thermal and electromagnetic interference of the tuning mechanism, helping ADMX scan for axions more accurately.

Ortega, Giancarlo [Marquette U.; Fermilab]↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

H2@Scale Program Multi-Party Cooperative Research and Development Agreement: California Hydrogen Infrastructure Research Consortium Task (Cooperative Research and Development Final Report, CRADA Number CRD-18-00754)

Many stakeholders are working on hydrogen and fuel cell products, markets, requirements, mandates, and policies. California has been leading the way for hydrogen infrastructure and fuel cell electric vehicle (FCEV) deployment. This leadership has advanced a hydrogen network that is not duplicated anywhere in the United States and is unique in the world for its focus on providing a retail fueling experience. In addition, the advancements have identified many lessons learned for hydrogen infrastructure development, deployment, and operation. Other interested states and countries are using California's experience as a model case, making success in California paramount to enabling market acceleration and uptake in the United States. The technical research capability of the national laboratories can be used to assist California in decisions and evaluations, as well as to verify solutions to problems impacting the industry. Because these challenges cannot be addressed by one agency or one laboratory, a hydrogen research consortium has been organized to combine and collaborate. The collaboration aims to ensure that data are available to evaluate projects and inform decision makers, independently verify and validate component solutions, provide experimental results for future hydrogen infrastructure, increase the availability of technical experts for quick-need issues for California hydrogen infrastructure development, deployment, operation, and technology advances. The proposed tasks include data collection from operational stations, component failure fix verification (i.e. nozzle freeze lock), new fueling methods for medium and heavy duty applications, and ensuring hydrogen quality is maintained. U.S. leadership for hydrogen technologies is rooted in California, a location for implementing many H2@Scale pathways such as reducing curtailment and stranded resources, reducing petroleum use and emissions, and developing and creating jobs.

08 HYDROGEN↗
DOE OSTI2022

A 20 Gbps PAM4 data transmitter ASIC for particle physics experiments

We present the design and test results of a novel data transmitter ASIC operating up to 20.48 Gbps with 4-level Pulse-Amplitude-Modulation (PAM4) for particle physics experiments. This ASIC, named GBS20, is fabricated in a 65 nm CMOS technology. Two serializers share a 5.12 GHz Phase Locked Loop (PLL) clock. The outputs from the serializers are combined into a PAM4 signal that directly drives a Vertical-Cavity-Surface-Emitting-Laser (VCSEL). The input data channels, each at 1.28 Gbps, are scrambled with an internal 2$^{7}$-1 Pseudo-Random Binary Sequence (PRBS), which also serves as a frame aligner. GBS20 is tested to work at 10.24 and 20.48 Gbps with a VCSEL-based Transmitter-Optical-Subassembly (TOSA). The power consumption of GBS20 is below 238 mW and reduced to 164 mW in the low-power mode.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2025

Insights into catalyst degradation during alkaline water electrolysis under variable operation

Energy conversion technologies that are key to decarbonization efforts face significant durability challenges due to variable operation. Understanding the impact of variable operation on catalytic stability and identifying the key variables that dictate degradation is crucial for developing robust technologies. Here, we present a comprehensive investigation of the effects of variable operation on liquid alkaline water electrolysis. Our findings reveal that variable operation induces severe degradation of Ni, Fe, and Co catalytic films that is not observed during steady-state operation. By systematically interrogating the electrode discharge during simulated shutdown tests using Raman spectroscopy and mass spectrometry techniques, we uncover significant alterations caused by reverse currents in real time. These include changes in crystal structure, composition, film thickness, electronic conductivity, and dissolution rates. Lab-scale electrolyzer experiments further highlight the impact of variable operation on catalyst materials under relevant conditions. Finally, we provide guidelines for leveraging these insights to advance electrocatalysis research. This work underscores the importance of integrating realistic stressors into stability testing and offers practical guidelines for catalyst design, performance evaluation, and industrial implementation. Collectively, insights from this study will drive the development of more resilient energy conversion technologies.

Marquez, Raul A. [Univ. of Texas, Austin, TX (Unit↗
DOE OSTI2026

Microsecond-latency feedback at a particle accelerator by online reinforcement learning on hardware

The commissioning and operation of future large-scale scientific experiments will challenge current tuning and control methods. Reinforcement learning (RL) algorithms are a promising solution due to their ability to dynamically adapt to changing environments and consider delayed consequences. In many real-world applications, RL policies must produce actions in real time, often within microseconds to milliseconds, imposing significant constraints on system latency and computational overhead that conventional machine learning libraries are not designed to handle. To control phenomena in real time at these timescales, RL needs to be deployed on-the-edge, namely on dedicated hardware located near the system it controls, without relying on a host CPU or cloud-based inference. In this work we present the design and deployment of an experience accumulator system in a particle accelerator. In this system, deep-RL algorithms run using hardware acceleration and act within a few microseconds, enabling the use of RL for control of phenomena like beam instabilities. The training uses the collected data offline to reduce the number of operations carried out on the acceleration hardware. The proposed architecture was tested in real experimental conditions at the Karlsruhe research accelerator, a synchrotron light source, where the system was used to control artificially induced horizontal betatron oscillations in real-time, with a control loop period of just 2.7 μs. The results showed a performance comparable to the commercial feedback system available at the accelerator, demonstrating the viability and potential of this approach. Due to the self-learning and reconfiguration capability of this implementation, a seamless application to other control problems is possible. Applications range from particle accelerators to large-scale research and industrial facilities.

FPGA↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗