Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “assets”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 919 records · Page 51
All sourcesNASA NTRSDOE OSTI
DOE OSTI2026

Cyber-Informed Engineering Power Generation Guide [Slides]

The CIE for Power Generation: Insights and Case Studies guide is being developed to assist engineers at utilities, asset owner-operators developers, and cybersecurity teams to build in robustness and cyber resiliency into their designs using cyber-informed engineering practices. This guide will break out these topics including use cases by chapters for areas such as Nuclear, IBRs, Geothermal, natural gas, etc.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Cybersecurity Incident Response Guide for Wind

As wind energy systems become increasingly digitized and interconnected, they face a growing array of cyber threats that can disrupt operations, compromise safety, and trigger cascading impacts across the energy ecosystem. The Wind Incident Response Guide provides a structured, wind-specific framework for preparing for, detecting, responding to, and recovering from cyber incidents. Drawing on lessons from field demonstrations, cyber-physical testbeds, and stakeholder engagement across the wind sector, this guide integrates technical, operational, and regulatory considerations to support asset owners, operators, and responders. It outlines key roles and responsibilities, maps incident response phases to wind-specific scenarios, and highlights applicable laws, regulations, standards, and best practices. By tailoring general cybersecurity principles to the unique architectures and operational constraints of wind systems—including remote access, legacy components, and environmental interfaces—this guide aims to enhance resilience, reduce response time, and support coordinated action across public and private stakeholders. It is intended as a practical resource for utilities, developers, regulators, and emergency managers working to secure the future of wind energy.

17 - WIND ENERGY↗
DOE OSTI2026

Final Design for Thermal/Epithermal eXperiments (TEX) with Lithium Absorbers to Provide Validation Benchmarks for Y-12 Electrorefining Facility (IER 575, CED-2 Report)

One of the main goals of the Thermal/Epithermal eXperiments (TEX) project is to use existing Nuclear Criticality Safety Program (NCSP) assets to create critical experiment plutonium and uranium test beds for materials important to criticality safety that have insufficient benchmark evaluations. The plutonium test bed experiments were completed in 2018 and are published in the 2020 edition of the International Criticality Safety Benchmark Evaluation Project (ICSBEP) Handbook. The uranium test bed assemblies were completed in 2023 and accepted in the 2024 edition of the ICSBEP Handbook.

73 NUCLEAR PHYSICS AND RADIATION PHYSICS↗
DOE OSTI2025

Securing the Modern Grid: Federal Investments, Digitization, and Supply Chain Strategy

Across the United States (U.S.) grid expansion and modernization is underway, paving the way for accelerated load growth and intelligent resource management. Digitization of the grid is supported by several state and federal programs, providing support for utilities installing advanced metering infrastructure (AMI), AI-powered analytics systems, battery energy storage systems (BESS), and distributed energy resource management systems (DERMS) to transform the grid from a one-way power delivery system into an intelligent, responsive network that will enable faster load growth and power expansion of data centers for advanced artificial intelligence (AI) applications. The digital transformation of America's grid presents opportunity for increased efficiency and resiliency but also introduces new digital risks that require careful management. Digital equipment often contains several vulnerabilities such as unencrypted communication protocols, and persistent remote access capabilities that could be exploited to manipulate device settings, coordinate service disruptions, or inject false data into grid operations. These digital risks become particularly important as the grid must rapidly scale to support AI-driven data centers, which the administration has identified as essential for maintaining U.S. technological leadership and economic competitiveness. These vulnerabilities are compounded by supply chain realities: Chinese manufacturers currently produce 70-90% of essential grid components including inverters, batteries, and control systems, with the U.S. lacking domestic manufacturing capacity for critical assets like extra-high voltage transformers. Recent federal legislation has established Foreign Entity of Concern (FEOC) restrictions to address these risks, requiring projects to achieve escalating thresholds of non-FEOC content to receive tax credits while utilities work to expand sourcing channels for their supply chains and strengthen security measures. These restrictions arrive precisely when utilities face unprecedented electricity demand growth driven by the rapid growth in data centers, creating a considerable challenge: rapidly expanding infrastructure while navigating complex compliance requirements while lacking viable alternatives for many critical components. Idaho National Laboratory (INL) and its partners have developed practical approaches to help utilities navigate these intersecting challenges as they leverage federal investment to strengthen and grow the grid. These solutions include Cyber-Informed Engineering (CIE) principles that build resilience directly into systems, the Cirrus tool for secure cloud migration, and enhanced procurement guidance that embeds security requirements throughout equipment lifecycles. Federal initiatives, such as the Technical Assistance for Digital Assurance (TADA) project, provide direct support to utilities implementing these approaches while facilitating knowledge sharing across the industry. While these tools and frameworks cannot eliminate all risks inherent in foreign supply chain dependencies, they offer pragmatic pathways for strengthening security posture without sacrificing the deployment momentum essential to meeting surging electricity demand. Ultimately, securing America's digital energy infrastructure demands dedicated coordination across multiple fronts: building domestic supply chains, implementing robust digital assurance practices, and maintaining the aggressive modernization timeline necessary for reliability, resilience, and energy independence.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

Navigating United States Standards and Regulation for Digital Energy Systems

This report provides an analysis of the U.S. standards and regulatory landscape for digital energy systems, focusing on cybersecurity, safety, and reliability requirements. It examines the interplay between federal mandates, state regulations, voluntary industry standards, and utility-specific policies, highlighting critical gaps between compliance and real-world risk mitigation. While NERC CIP standards enforce cybersecurity for Bulk Electric System assets, distribution-level infrastructure and emerging technologies often fall outside mandatory oversight, creating vulnerabilities. The report identifies systemic challenges such as reliance on self-attestation, uneven state adoption of safety codes, and lagging standards for advanced technologies like battery energy storage and inverter-based resources. Through a detailed gap analysis, it underscores the urgency of proactive risk-based approaches, independent verification, and strategic engagement with state and federal entities. Recommendations include adopting tiered security frameworks, strengthening procurement practices, and addressing emerging technology risks to ensure resilient and secure digital energy infrastructure. This guidance is intended for utilities, regulators, and stakeholders navigating compliance obligations and seeking to enhance cybersecurity and safety beyond minimum standards.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Cyclotron Road Partnership (CRADA Final Report)

The Cyclotron Road program was launched in 2015 by LBNL, with support from the DOE Advanced Manufacturing Office (AMO), to accelerate technical innovation in the energy sector. The program brought scientist-entrepreneurs to LBNL to access unique research assets and expertise. In 2016, LBNL partnered with Activate Global, Inc., a 501(c)(3) non-profit, to expand the program and provide enhanced access to capital and business support services. Under this Cooperative Research and Development Agreement (CRADA), LBNL provided technical support and expertise, while Activate engaged with private sector, philanthropic, and government partners to support innovators and research-phase small businesses, aiming to translate high-impact materials and manufacturing technologies from lab to market. The program received funding from various sponsors, including the DOE, DARPA, and the California Energy Commission, and was managed through a collaborative framework that maintained accountability by the participant organization and Berkeley Lab regarding roles and tasks relevant to this collaboration.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2025

WRPS Hanford Update [Slides]

The purpose of this report is to coordinate with the staff from WRPS, the current contract holder for operations at the Hanford site to better inform design decisions for the Autonomous systems for Hanford waste tank handling project. The project goals are to support risk reduction associated with monitoring, inspection and mapping of Hanford tank underground pits and includes: 1. A pit mock-up demonstration of Idaho National Laboratory’s (INL) Autonomous Pit Exploration System (APES) technology, which has two configurations: A. The Autonomous Robotic Arm, which is a proposed collaboration with Florida International University (FIU) and has capabilities to visually inspect, monitor, map and conduct simple tool manipulation tasks in the tank pits, and B. The robotic crawler configuration, which has capabilities to deploy to the bottom of the pits and conduct closer and bottom-up visual inspections. 2. An Implementation Plan that identifies Hanford site-wide application of the INL remote robotics technologies to enhance the performance of the tank farm systems and the characterization of the waste they contain to mitigate risk and optimize the overall waste mission. 3. A first-of-a-kind environmental digital twin will be produced. Digital twins to date require permanently installed sensors in order to produce asset specific predictions. This project will use the intermittent signals during inspections from deployed sensors on robotic systems to produce the data sets used by AI/ML to enable predictions of issues on tanks.

42 - ENGINEERING↗
DOE OSTI2026

LDRD FY25 Program Overview

As Lawrence Livermore National Laboratory’s (LLNL’s) Laboratory Directed Research and Development (LDRD) program enters its fifth decade of leading-edge research and development, its impact and importance have never been stronger. The program continues to advance strategic investments in pioneering science, technology, and engineering, ensuring LLNL will be ready to deliver on our mission as it evolves over the coming decades. Investing in LDRD research, and the people who perform this critical work, gives LLNL the ability to sustain our role as a leader in the Department of Energy and National Nuclear Security Administration enterprise. The LDRD program enables high-risk, high-payoff research that anticipates emerging threats and future mission needs. By nurturing the ingenuity of the Lab’s greatest asset, its people, LDRD funding advances not only our research but also grows and nurtures our workforce: engaging future innovators with student mentoring, challenging postdoctoral researchers to apply their skills to support national security, and strengthening the leadership skills of early career staff. This annual report documents how LDRD investments advance LLNL’s science, technology, and engineering across our mission space. To assess LDRD’s impact we track both short and long-term metrics such as peer-reviewed publications, number of students, or professional fellows. In addition to reviewing these metrics, I encourage you to delve deeper into the breadth of science and technology that illustrate the strategic value of this research portfolio. For instance, a recent exploratory research project used advanced manufacturing to construct miniaturized three-dimensional ion traps for a quantum computer with reduced quantum error rates to enable applications that address national security missions and support basic science. Another project has delved into studying detonation by examining deflagration to enhance the safety and security of the nuclear weapons stockpile. LDRD researchers are also deploying AI agents on two of the world’s most powerful supercomputers to automate and accelerate inertial confinement fusion experiments. Other teams are delivering more accurate optical constants to enable improved validation for aluminum to advance atomic and molecular physics models. LDRD-driven discoveries of how metals deform under extreme conditions strengthen our ability to model and design materials for demanding national security environments. National security challenges are increasingly complex and continuously evolving. LDRD focuses our most innovative science and technology on these challenges, ensuring the Laboratory is developing creative, forward-leaning solutions for our nation and the world. The following pages feature highlights of published scientific advances, patents, and honors that stem from LDRD investments. As you read this report, I hope you will understand how these investments position the Laboratory, and our partners, to meet the demands of the decades ahead.

36 MATERIALS SCIENCE↗
DOE OSTI2026

A Community Guide to Regulatory Barriers Affecting Microgrids (Reports 1-3)

In response to growing risks of power outages from extreme weather and aging infrastructure, communities are increasingly exploring the potential of microgrids to provide reliable energy access. Microgrids offer promising solutions to meet this challenge but face a complex landscape of non-technical barriers, particularly regulations concerning the provision and distribution of energy. Most existing legal and regulatory frameworks were designed for a centralized, one-way power system, and are often poorly suited to handle systems that independently balance distributed energy resources with local load. This three-part report series provides a strategic analysis of existing regulatory and legal factors affecting microgrid deployments to help non-technical community leaders and decision-makers better understand the feasibility of a microgrid in their community. -Report No. 1: Foundational Issues Facing Microgrids details the universal policy barriers all microgrids face, including utility interconnection processes, rate structures, and local permitting. -Report No. 2: Single Property Microgrids outlines how direct asset ownership and operating behind-the-meter can bypass some regulatory oversight, using the Blue Lake Rancheria microgrid as a case study. -Report No. 3: Multi-Property Microgrids tackles the complex challenges of crossing public rights-of-way and navigating utility franchise rights, highlighting the Coventry microgrid project. The series equips decision-makers with phased frameworks to navigate financial and regulatory complexities, engage effectively with local utilities and Authorities Having Jurisdiction (AHJs), and structure successful microgrid projects.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

A Systematic Review and Integrated Approach to Modeling of Aging Utility Scale PV Systems

The growing deployment of utility-scale photovoltaic (PV) systems has increased the importance of techno-economic modeling operational photovoltaic (PV) systems for predicting energy yield, optimizing asset management, and informing financial decisions. Through a systematic review of literature and current industry practices, we review the different common modeling practices of a system's configuration and age, performance and degradation, operation and maintenance (O&M), while also focusing on specific considerations for repowering, revamping, and decommissioning. Building on the synthesis, we develop a structured framework for techno-economic modeling of operating PV systems that integrate performance and degradation analysis, a decommissioning and repowering cost model that estimates the system's end-of-life costs to reduce uncertainty quantifications and improve consistency across the sector. This research contributes to improved modeling methodologies and potentially to reduced financial performance requirements by providing practitioners with input resources and practical approaches to estimate performance, degradation, and costs associated with continued operation, revamping, repowering, or decommissioning decisions.

14 SOLAR ENERGY↗
DOE OSTI2026

High-Torque Heavy-Rare-Earth-Free Electric Motor Thermal Management

This project is part of a multi-lab Next-Generation Reliable Electric Drive Systems for Medium and Heavy-Duty Vehicles (NEXT-DRIVE) project led by Oak Ridge National Laboratory (ORNL), and including NREL, Sandia National Laboratories (SNL), and Ames Laboratory that leverages research expertise and facilities of these national labs to develop tools and approaches for reducing the design and development time of new electric drive technologies for medium and heavy-duty vehicles (MHDVs) and their associated costs while increasing reliability and asset utilization. The Next-Drive project aligns with the DOE's goals by introducing high-fidelity multi-physics and AI/ML-based modeling to design low-cost, highly reliable, and longer-lifetime drivetrains, aiming to achieve 25 years of progress in 5 years. The efforts of this project will focus on NEXT-DRIVE Task 4 (led by ORNL, NREL, and AMES) - developing high-fidelity modeling framework and identifying technologies enabling heavy-rare-earth-free electric motors for medium- and heavy-duty vehicles to achieve 1 million miles of operation. Contrary to conventional approaches that optimize the motor for power density, the focus will be to identify motor designs that achieve the best trade-off between motor power density and durable operation. NREL tasks include development of high-fidelity motor thermal models incorporating rotor windage losses and identification, evaluation and measurement of motor interface materials in key thermal pathways. The poster summarizes NREL's accomplishments for the first half of FY 2025 and outlines future plans.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2026

CoURAGE KAZR b1 Processing: Corrections, Calibrations, and Processing Report

The U.S. Department of Energy (DOE) Atmospheric Radiation Measurement (ARM) User Facility supports atmospheric and earth system research through a comprehensive network of fixed and mobile observatories. These facilities provide long-term and intensive campaign-based observations of clouds, aerosols, precipitation, radiation, and meteorological state variables. ARM observations are designed to improve the physical understanding and numerical representation of atmospheric processes in earth system models, with particular emphasis on cloud-radiation interactions and precipitation processes. The Coast-Urban-Rural Atmospheric Gradient Experiment (CoURAGE) deploys one of the ARM Mobile Facilities (AMF) to the Mid-Atlantic region surrounding Baltimore, Maryland, for the period 1 December 2024 through 30 November 2025. This deployment focuses on characterizing atmospheric structure, cloud properties, and precipitation processes across strong land-use and surface heterogeneity gradients associated with urban, rural, and coastal (Chesapeake Bay) environments. The CoURAGE deployment complements the Baltimore Social-Environmental Collaborative (BSEC), a DOE Urban Integrated Field Laboratory (UIFL), by providing high-quality atmospheric observations needed to connect urban surface processes, emissions, and meteorology to cloud and precipitation responses. In addition to the central urban site, ancillary observing sites were deployed to rural Maryland northwest of Baltimore and to an island site in Chesapeake Bay. These measurements further complement a long-term atmospheric observatory operated in Beltsville, Maryland, by Howard University in collaboration with the Maryland Department of the Environment. Together, these assets form a four-node regional atmospheric observatory network representing Baltimore and its three primary surrounding environments—urban, rural, and coastal/bay. This coordinated observational strategy enables investigation of spatial gradients in boundary-layer structure, cloud occurrence, precipitation evolution, and aerosol-cloud interactions across complex surface regimes. Within this network, vertically pointing cloud radars play a critical role by providing continuous, high-resolution measurements of cloud and precipitation vertical structure.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2026

Advanced Computing Annual Report 2025 [Slides]

In Fiscal Year (FY) 2025, the National Laboratory of the Rockies (NLR) continued to advance computing as a cornerstone of energy innovation, expanding the Kestrel high-performance computing (HPC) system to 56 peak petaflops. This growth strengthened Kestrel's role as a national asset for applied energy research, enabling larger, more complex simulations and accelerating the integration of artificial intelligence (AI) methods across the laboratory's computing portfolio. In FY 2025, AI was a component of most projects running on Kestrel, underscoring its central role in modern energy science and engineering. Kestrel supported a broad and diverse set of 507 modeling and simulation projects, engaging 855 researchers across the U.S. Department of Energy's (DOE's) Office of Critical Minerals and Energy Innovation (CMEI) portfolio and other offices, as well as partners from industry, academia, and utilities. These efforts span critical materials discovery, energy systems modeling, grid modernization, advanced manufacturing, and other areas essential to strengthening U.S. energy security and competitiveness. Together, these collaborations produced 708 technical outputs, including 293 peer-reviewed publications, reflecting both the depth and impact of the science enabled by NLR's computing capabilities. This year's report highlights the growing importance and benefit of AI throughout NLR's research programs and features work by early career researchers who are helping shape the future of computing-enabled energy innovation. Explore these sections and the many project successes captured in the pages that follow.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗