SEARCH · Engineering Papers

Results for “Comprehension”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,009 records · Page 56

All sources NASA NTRS DOE OSTI

DOE OSTI2024

Large reductions in Permian Basin methane intensity shown in multi-year comparison of aerially-visible methane emissions

Spanning the US states of Texas and New Mexico, the Permian Basin has been a hotspot of methane emissions from oil and natural gas activity 1–4, although studies disagree over the magnitude of these emissions. The most comprehensive measurement campaigns published were conducted in 2019 1–5 .There have been large changes in the energy industry since then, including in the prices of oil and gas, both state and federal regulatory environments, investor and activist pressure over methane emissions, and the adoption of new technologies and policies by energy operators. Understanding how any or all of these might influence methane emissions is important for policy makers, oil and gas operators, and other stakeholders. We characterize the time evolution of Permian Basin methane emissions using a series of comprehensive aerial surveys conducted every year from 2020-2023 and compare them to the 2019 results cited above. To maintain comparability, all the data sets are from surveys using Insight M point source methane sensing technology. The scope of these surveys expanded over time: from 33-46% of wells, oil production, and gas production in 2020 to 60-65% in 2021, to 84% of wells and over 90% of both oil and gas production in 2023. These surveys by Insight M also include hundreds of gas processing plants and compressor stations as well as 1000s of km of gathering and transmission pipelines. Considering only the aerially detected portion of emissions (typically the majority of the total in such surveys 4), we find reductions of more than 70% in methane emissions intensity compared to the 2019 New Mexico-only Insight M survey, with variation depending on the year 3,4. Notably, although sources below 100 kg/hr contributed less than 10% of aerially measured emissions the 2019 New Mexico survey 3, these smaller sources constitute a larger proportion of total aerially measured emissions (although not the majority) in 2020-2023. Production facilities and gathering pipelines are responsible for the larges shares of total emissions, followed by compressor stations and gas processing plants. Permian methane emissions were also measured in a comprehensive 2019 Permian-wide survey by the Carbon Mapper team 2. That analysis led to a lower total emissions estimate at the time 4. These new Insight M-based emission rates are still roughly 30-70% lower than the aerially measured portion of the 2019 Carbon Mapper-based estimates 4. Further work is needed to harmonize these surveys in space and time to create the most intercomparable numbers possible 5. Additional analysis is needed to compare our findings to the more spatially constrained 2020, 2021, and 2023 Carbon Mapper surveys in the Permian 4,6. The evidence is strong from these two survey teams that emissions intensity has declined significantly since 2019. Reasons for this trend are currently unclear but point to possible success of emissions control programs. Future work investigating frequency, source, and operator-specific intensities could provide insights into the causes of this promising trend.

methane, oil and gas, data science, remote sensing↗

DOE OSTI2024

CarbonSAFE Phase II: Optimizing Alabama’s CO 2 Storage in Shelby County, Alabama (Project OASIS), Milestone M3 - Site Specific Drilling Report

The Phase II Storage Complex Feasibility project, entitled "Optimizing Alabama's CO 2 Storage in Shelby County, Alabama (Project OASIS)," is a part of the DOE/NETL's CarbonSAFE initiative. The Project is managed by the Southern States Energy Board (SSEB), and includes participation from Advanced Resources International, Inc. (ARI), Crescent Resource Innovation, Southern Company, Alabama A&M University, Auburn University, and Oklahoma State University. Project OASIS is working to establish the foundation for a commercial-scale geologic storage complex for CO 2 captured from Plant Gaston (home of the National Carbon Capture Center) and surrounding industrial sources of CO 2 located in Shelby County, Alabama. The Project objectives are: • Demonstrate that the subsurface saline formations at the storage complex can store commercial volumes of CO 2 safely and permanently. • Develop a comprehensive Community Benefits Plan. • Develop the infrastructure framework for a CO 2 storage hub. • Develop a rigorous risk registry and to conduct a comprehensive risk assessment. • Develop a monitoring plan. • Develop a comprehensive site characterization plan to support an Underground Injection Control Class VI Permit in a future Phase III program. • Evaluate the commercial viability of the project. Project OASIS is about 30 miles southeast of Birmingham, Alabama within a geologic province called the Valley and Ridge (Figure 1.1). The Valley and Ridge Province comprises a sequence of Paleozoic carbonate and clastic rocks that underwent structural deformation during the Alleghanian Orogeny. Storage prospects occur in relatively flat lying structural panels located between thrust faults. Available geologic studies related to hydrocarbon exploration suggest that Cambro-Ordovician carbonates and Cambrian clastic units offer multiple potential storage intervals, and that regional confining systems are present, such as the tectonically thickened Floyd-Parkwood Shale. The surface property is owned by a timber and land stewardship company, The Westervelt Company, Inc., who worked with the Project Team to select and prepare adequate sites for geologic assessment. The purpose of drilling the Westover Stratigraphic Test Well #2 was to collect geologic data to model the feasibility of commercial scale CO 2 injection and storage. This includes geological and geophysical evaluations, reservoir engineering analyses, and risk assessments.

20 FOSSIL-FUELED POWER PLANTS↗

DOE OSTI2025

Tactical Analysis for Calculating Contextual Risk at Boundaries: Summary of Laboratory Directed Research & Development Effort

The Tactical Analysis for Calculating Contextual Risk at Boundaries (TACCRAB) tool is an innovative digital twin (DT) platform and automated risk algorithm designed to transform operational decision-making in structured screening environments, with an initial focus on Southern Border Land Ports of Entry (POEs). The invention provides integration points for advanced artificial intelligence, predictive modeling, and real-time data analysis to produce a comprehensive risk management tool that enables proactive, data-informed security strategies. The core inventive features of TACCRAB center on its unique risk algorithm, which dynamically calculates contextual risk by synthesizing historical data, near real-time streaming data from the checkpoints themselves, and AI-generated predictions. Unlike traditional risk assessment methods, TACCRAB utilizes a DT to provide comprehensive operational insights, allowing stakeholders to visualize, simulate, and optimize checkpoint configurations with unprecedented speed and contextual awareness. TACCRAB's key innovation lies in its ability to combine multiple complex inputs - including technology detection probabilities, resource availability, screening pathway characteristics, and threat actor behavioral patterns - into a unified risk calculation and update these inputs based on changing operational and environmental conditions. By leveraging a DT that continuously updates and learns from linked data, TACCRAB can suggest adaptive mitigation strategies that minimize risk while maintaining operational efficiency. Particularly novel is the platform's approach to decision support, which goes beyond static risk assessment. The DT provides dynamic metrics such as wait times, resource allocation effectiveness, and potential emerging threat scenarios, enabling users to view sophisticated, relevant what-if simulations and optimize checkpoint operations in near real-time. The system's architecture allows for generalized application across different screening environments, such as secure facilities, ports of entry, and soft targets, making it a versatile tool for security and operational management. The invention distinguishes itself through its comprehensive integration of predictive modeling, AI-driven pattern discovery, and user-friendly interface design. By combining these elements, TACCRAB transforms complex risk data into actionable insights, supporting decision-makers at various organizational levels - from booth agents making split-second screening decisions to checkpoint managers optimizing the day's resource allocation to strategic planners managing long-term investments.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2024

Hanford Site Raptor Nest Monitoring Report for Calendar Year 2022

The U.S. Department of Energy, Richland Operations Office (DOE-RL), conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing DOE-RL activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOERL stewardship at the Hanford Site required for decision making under the National Environmental Policy Act of 1969 (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act of 1980. DOE/EIS-0222, Final Hanford Comprehensive Land Use Plan Environmental Impact Statement, (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years and ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2025

Hanford Reach Fall Chinook Salmon Redd Monitoring Report for Calendar Year 2024

The U.S. Department of Energy, Hanford Field Office (HFO) conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing HFO activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under HFO stewardship at the Hanford Site required for decision making under the National Environmental Policy Act (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act. DOE/EIS-0222, Final Hanford Comprehensive Land-Use Plan Environmental Impact Statement, (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years, and ensures that HFO, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2025

Hanford Reach Fall Chinook Salmon Redd Monitoring Report for Calendar Year 2023

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2024

Hanford Reach Fall Chinook Salmon Redd Monitoring Report for Calendar Year 2022

The U.S. Department of Energy, Richland Operations Office (DOE-RL) conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing DOE-RL activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOE-RL stewardship at the Hanford Site required for decision making under the National Environmental Policy Act (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act. DOE/EIS-0222, Final Hanford Comprehensive Land-Use Plan Environmental Impact Statement, (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years, and ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Hanford Reach Fall Chinook Salmon Redd Monitoring Report for Calendar Year 2021

The U.S. Department of Energy, Richland Operations Office (DOE-RL), conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing DOE-RL activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOE-RL stewardship at the Hanford Site required for decision making under the National Environmental Policy Act (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act. DOE/EIS-0222, Final Hanford Comprehensive Land-Use Plan Environmental Impact Statement, (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years, and ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2021

Hanford Reach Fall Chinook Salmon Redd Monitoring Report for Calendar Year 2020

The U.S. Department of Energy, Richland Operations Office (DOE-RL) conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing DOE-RL activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOE-RL stewardship at the Hanford Site required for decision making under the National Environmental Policy Act (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act. DOE/EIS-0222, Final Hanford Comprehensive Land Use Plan Environmental Impact Statement, (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years, and ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2020

Hanford Reach Fall Chinook Salmon Redd Monitoring Report for Calendar Year 2019

The U.S. Department of Energy, Richland Operations Office (DOE-RL) conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing DOE-RL activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOE-RL stewardship at the Hanford Site required for decision making under the National Environmental Policy Act (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act. DOE/EIS-0222, Final Hanford Comprehensive Land Use Plan Environmental Impact Statement (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years, and ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2020

Hanford Reach Fall Chinook Redd Monitoring Report for Calendar Year 2018

The U.S. Department of Energy, Richland Operations Office (DOE-RL) conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing DOE-RL activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOE-RL stewardship at the Hanford Site required for decision making under the National Environmental Policy Act (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act. DOE/EIS-0222, Final Hanford Comprehensive Land Use Plan Environmental Impact Statement (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years, and ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2020

Hanford Reach Fall Chinook Redd Monitoring Report for Calendar Year 2017

The U.S. Department of Energy, Richland Operations Office (DOE-RL) conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with an array of environmental laws, regulations, and policies governing DOE-RL activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOE-RL stewardship at the Hanford Site required for decision making under the National Environmental Policy Act (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA). DOE/EIS-0222, Final Hanford Comprehensive Land Use Plan Environmental Impact Statement (CLUP) evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site for at least the next 50 years, and ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2021

Hanford Site Mule Deer Monitoring Report for Fiscal Year 2019

The U.S. Department of Energy, Richland Operations Office (DOE-RL) conducts ecological monitoring on the Hanford Site to collect and track data needed to ensure compliance with environmental laws, regulations, and policies governing Department of Energy activities. Ecological monitoring data provide baseline information about the plants, animals, and habitats under DOE-RL stewardship at the Hanford Site required for decision-making under the National Environmental Policy Act of 1969 (NEPA) and Comprehensive Environmental Response, Compensation, and Liability Act of 1980. The Hanford Site Comprehensive Land Use Plan (CLUP, DOE 1999), which is the Environmental Impact Statement that evaluates the potential environmental impacts associated with implementing a comprehensive land-use plan for the Hanford Site, ensures that DOE-RL, its contractors, and other entities conduct activities on the Hanford Site in compliance with NEPA.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2025

The Snow Albedo Evolution (SALVO) Campaign at the North Slope of Alaska Field Campaign Report

The springtime surface-albedo transition in the Alaskan Arctic, along with the forces that determine its duration and nature, was the focus of the Snow ALbedo eVOlution (SALVO) campaign. The SALVO team investigated the reasons and durations of the stages of spring melt, during which albedo values decrease from 0.8 to 0.1, signifying the year’s largest and most significant radiative energy change. SALVO II (2022, 2024) built on findings from the successful SALVO I (2019) melt season campaign and previous research on the melt transition period conducted by Grenfell and Perovich (2004). SALVO used the ARM NSA observatory, thus aligning with a core principle of the ARM Decadal Vision to “provide comprehensive and impactful field measurements to support scientific advancement of atmospheric process understanding.” SALVO fieldwork was conducted in the spring near the ARM NSA Central Facility in Utqiagvik, Alaska (Figure 1). Comprehensive data sets were collected in 2019, 2022, and 2024, which included spectral and broadband albedos, snow and meltwater depths, snow stratigraphy, snow grain size data, and aerial imagery. In April of each project year, before the snow began to melt, we established survey lines at three or four locations: inland tundra at NSA E12, coastal tundra at the NSA C1 site, Elson Lagoon, and offshore on the Chukchi Sea sea ice (2022 only). We set up a 200-meter-long line, marked every five meters, to enable repeated measurements of surface albedo and snow depth at each location. During most site visits, the SALVO II team dug at least one snow pit to assess the characteristics of the vertical snow layers, including the types and sizes of snow grains, snow density, and the distribution of liquid water. We evaluated the characteristics of flowing or pooled water at the bottom of the snowpack. Watching snow melt in the Arctic has been compared by some to being as exciting as watching paint dry, but it is far more exciting and dynamic than that. Initially, changes happen slowly while the snow cover remains above 80%, but then reductions in the albedo of the landscape, from about 0.8 to 0.4, combined with rising spring temperatures, begin to accelerate the melt. It happens so quickly that no matter how hard the field team works, they cannot keep up with documenting the changes. At first, liquid water is scarce—only a few wet layers of snow in the snowpack. But then, water becomes ubiquitous, transporting melt energy and creating an extremely heterogeneous albedo and melt landscape. At the end of each field season, the SALVO team is exhausted, relieved to see the snow gone, and joyful to play in the melt ponds on the sea ice under the midnight sun. Overall, the 2024 SALVO field campaign was a highlight, reflecting numerous lessons learned from 2019 and 2022. Daily measurements were taken more than 10 times at each site, resulting in a comprehensive time series of snow conditions and albedo. The team deployed using snowmachines and then on foot when snowmachine travel was no longer permitted on the melting tundra. Instrument mounts and packaging were optimized for quick deployment, regardless of the mode of transportation.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗