Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Asset”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,315 records · Page 73
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Cyclotron Road Partnership (CRADA Final Report)

The Cyclotron Road program was launched in 2015 by LBNL, with support from the DOE Advanced Manufacturing Office (AMO), to accelerate technical innovation in the energy sector. The program brought scientist-entrepreneurs to LBNL to access unique research assets and expertise. In 2016, LBNL partnered with Activate Global, Inc., a 501(c)(3) non-profit, to expand the program and provide enhanced access to capital and business support services. Under this Cooperative Research and Development Agreement (CRADA), LBNL provided technical support and expertise, while Activate engaged with private sector, philanthropic, and government partners to support innovators and research-phase small businesses, aiming to translate high-impact materials and manufacturing technologies from lab to market. The program received funding from various sponsors, including the DOE, DARPA, and the California Energy Commission, and was managed through a collaborative framework that maintained accountability by the participant organization and Berkeley Lab regarding roles and tasks relevant to this collaboration.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2025

WRPS Hanford Update [Slides]

The purpose of this report is to coordinate with the staff from WRPS, the current contract holder for operations at the Hanford site to better inform design decisions for the Autonomous systems for Hanford waste tank handling project. The project goals are to support risk reduction associated with monitoring, inspection and mapping of Hanford tank underground pits and includes: 1. A pit mock-up demonstration of Idaho National Laboratory’s (INL) Autonomous Pit Exploration System (APES) technology, which has two configurations: A. The Autonomous Robotic Arm, which is a proposed collaboration with Florida International University (FIU) and has capabilities to visually inspect, monitor, map and conduct simple tool manipulation tasks in the tank pits, and B. The robotic crawler configuration, which has capabilities to deploy to the bottom of the pits and conduct closer and bottom-up visual inspections. 2. An Implementation Plan that identifies Hanford site-wide application of the INL remote robotics technologies to enhance the performance of the tank farm systems and the characterization of the waste they contain to mitigate risk and optimize the overall waste mission. 3. A first-of-a-kind environmental digital twin will be produced. Digital twins to date require permanently installed sensors in order to produce asset specific predictions. This project will use the intermittent signals during inspections from deployed sensors on robotic systems to produce the data sets used by AI/ML to enable predictions of issues on tanks.

42 - ENGINEERING↗
DOE OSTI2026

LDRD FY25 Program Overview

As Lawrence Livermore National Laboratory’s (LLNL’s) Laboratory Directed Research and Development (LDRD) program enters its fifth decade of leading-edge research and development, its impact and importance have never been stronger. The program continues to advance strategic investments in pioneering science, technology, and engineering, ensuring LLNL will be ready to deliver on our mission as it evolves over the coming decades. Investing in LDRD research, and the people who perform this critical work, gives LLNL the ability to sustain our role as a leader in the Department of Energy and National Nuclear Security Administration enterprise. The LDRD program enables high-risk, high-payoff research that anticipates emerging threats and future mission needs. By nurturing the ingenuity of the Lab’s greatest asset, its people, LDRD funding advances not only our research but also grows and nurtures our workforce: engaging future innovators with student mentoring, challenging postdoctoral researchers to apply their skills to support national security, and strengthening the leadership skills of early career staff. This annual report documents how LDRD investments advance LLNL’s science, technology, and engineering across our mission space. To assess LDRD’s impact we track both short and long-term metrics such as peer-reviewed publications, number of students, or professional fellows. In addition to reviewing these metrics, I encourage you to delve deeper into the breadth of science and technology that illustrate the strategic value of this research portfolio. For instance, a recent exploratory research project used advanced manufacturing to construct miniaturized three-dimensional ion traps for a quantum computer with reduced quantum error rates to enable applications that address national security missions and support basic science. Another project has delved into studying detonation by examining deflagration to enhance the safety and security of the nuclear weapons stockpile. LDRD researchers are also deploying AI agents on two of the world’s most powerful supercomputers to automate and accelerate inertial confinement fusion experiments. Other teams are delivering more accurate optical constants to enable improved validation for aluminum to advance atomic and molecular physics models. LDRD-driven discoveries of how metals deform under extreme conditions strengthen our ability to model and design materials for demanding national security environments. National security challenges are increasingly complex and continuously evolving. LDRD focuses our most innovative science and technology on these challenges, ensuring the Laboratory is developing creative, forward-leaning solutions for our nation and the world. The following pages feature highlights of published scientific advances, patents, and honors that stem from LDRD investments. As you read this report, I hope you will understand how these investments position the Laboratory, and our partners, to meet the demands of the decades ahead.

36 MATERIALS SCIENCE↗
DOE OSTI2026

A Community Guide to Regulatory Barriers Affecting Microgrids (Reports 1-3)

In response to growing risks of power outages from extreme weather and aging infrastructure, communities are increasingly exploring the potential of microgrids to provide reliable energy access. Microgrids offer promising solutions to meet this challenge but face a complex landscape of non-technical barriers, particularly regulations concerning the provision and distribution of energy. Most existing legal and regulatory frameworks were designed for a centralized, one-way power system, and are often poorly suited to handle systems that independently balance distributed energy resources with local load. This three-part report series provides a strategic analysis of existing regulatory and legal factors affecting microgrid deployments to help non-technical community leaders and decision-makers better understand the feasibility of a microgrid in their community. -Report No. 1: Foundational Issues Facing Microgrids details the universal policy barriers all microgrids face, including utility interconnection processes, rate structures, and local permitting. -Report No. 2: Single Property Microgrids outlines how direct asset ownership and operating behind-the-meter can bypass some regulatory oversight, using the Blue Lake Rancheria microgrid as a case study. -Report No. 3: Multi-Property Microgrids tackles the complex challenges of crossing public rights-of-way and navigating utility franchise rights, highlighting the Coventry microgrid project. The series equips decision-makers with phased frameworks to navigate financial and regulatory complexities, engage effectively with local utilities and Authorities Having Jurisdiction (AHJs), and structure successful microgrid projects.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

A Systematic Review and Integrated Approach to Modeling of Aging Utility Scale PV Systems

The growing deployment of utility-scale photovoltaic (PV) systems has increased the importance of techno-economic modeling operational photovoltaic (PV) systems for predicting energy yield, optimizing asset management, and informing financial decisions. Through a systematic review of literature and current industry practices, we review the different common modeling practices of a system's configuration and age, performance and degradation, operation and maintenance (O&M), while also focusing on specific considerations for repowering, revamping, and decommissioning. Building on the synthesis, we develop a structured framework for techno-economic modeling of operating PV systems that integrate performance and degradation analysis, a decommissioning and repowering cost model that estimates the system's end-of-life costs to reduce uncertainty quantifications and improve consistency across the sector. This research contributes to improved modeling methodologies and potentially to reduced financial performance requirements by providing practitioners with input resources and practical approaches to estimate performance, degradation, and costs associated with continued operation, revamping, repowering, or decommissioning decisions.

14 SOLAR ENERGY↗
DOE OSTI2026

High-Torque Heavy-Rare-Earth-Free Electric Motor Thermal Management

This project is part of a multi-lab Next-Generation Reliable Electric Drive Systems for Medium and Heavy-Duty Vehicles (NEXT-DRIVE) project led by Oak Ridge National Laboratory (ORNL), and including NREL, Sandia National Laboratories (SNL), and Ames Laboratory that leverages research expertise and facilities of these national labs to develop tools and approaches for reducing the design and development time of new electric drive technologies for medium and heavy-duty vehicles (MHDVs) and their associated costs while increasing reliability and asset utilization. The Next-Drive project aligns with the DOE's goals by introducing high-fidelity multi-physics and AI/ML-based modeling to design low-cost, highly reliable, and longer-lifetime drivetrains, aiming to achieve 25 years of progress in 5 years. The efforts of this project will focus on NEXT-DRIVE Task 4 (led by ORNL, NREL, and AMES) - developing high-fidelity modeling framework and identifying technologies enabling heavy-rare-earth-free electric motors for medium- and heavy-duty vehicles to achieve 1 million miles of operation. Contrary to conventional approaches that optimize the motor for power density, the focus will be to identify motor designs that achieve the best trade-off between motor power density and durable operation. NREL tasks include development of high-fidelity motor thermal models incorporating rotor windage losses and identification, evaluation and measurement of motor interface materials in key thermal pathways. The poster summarizes NREL's accomplishments for the first half of FY 2025 and outlines future plans.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2026

CoURAGE KAZR b1 Processing: Corrections, Calibrations, and Processing Report

The U.S. Department of Energy (DOE) Atmospheric Radiation Measurement (ARM) User Facility supports atmospheric and earth system research through a comprehensive network of fixed and mobile observatories. These facilities provide long-term and intensive campaign-based observations of clouds, aerosols, precipitation, radiation, and meteorological state variables. ARM observations are designed to improve the physical understanding and numerical representation of atmospheric processes in earth system models, with particular emphasis on cloud-radiation interactions and precipitation processes. The Coast-Urban-Rural Atmospheric Gradient Experiment (CoURAGE) deploys one of the ARM Mobile Facilities (AMF) to the Mid-Atlantic region surrounding Baltimore, Maryland, for the period 1 December 2024 through 30 November 2025. This deployment focuses on characterizing atmospheric structure, cloud properties, and precipitation processes across strong land-use and surface heterogeneity gradients associated with urban, rural, and coastal (Chesapeake Bay) environments. The CoURAGE deployment complements the Baltimore Social-Environmental Collaborative (BSEC), a DOE Urban Integrated Field Laboratory (UIFL), by providing high-quality atmospheric observations needed to connect urban surface processes, emissions, and meteorology to cloud and precipitation responses. In addition to the central urban site, ancillary observing sites were deployed to rural Maryland northwest of Baltimore and to an island site in Chesapeake Bay. These measurements further complement a long-term atmospheric observatory operated in Beltsville, Maryland, by Howard University in collaboration with the Maryland Department of the Environment. Together, these assets form a four-node regional atmospheric observatory network representing Baltimore and its three primary surrounding environments—urban, rural, and coastal/bay. This coordinated observational strategy enables investigation of spatial gradients in boundary-layer structure, cloud occurrence, precipitation evolution, and aerosol-cloud interactions across complex surface regimes. Within this network, vertically pointing cloud radars play a critical role by providing continuous, high-resolution measurements of cloud and precipitation vertical structure.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2026

Advanced Computing Annual Report 2025 [Slides]

In Fiscal Year (FY) 2025, the National Laboratory of the Rockies (NLR) continued to advance computing as a cornerstone of energy innovation, expanding the Kestrel high-performance computing (HPC) system to 56 peak petaflops. This growth strengthened Kestrel's role as a national asset for applied energy research, enabling larger, more complex simulations and accelerating the integration of artificial intelligence (AI) methods across the laboratory's computing portfolio. In FY 2025, AI was a component of most projects running on Kestrel, underscoring its central role in modern energy science and engineering. Kestrel supported a broad and diverse set of 507 modeling and simulation projects, engaging 855 researchers across the U.S. Department of Energy's (DOE's) Office of Critical Minerals and Energy Innovation (CMEI) portfolio and other offices, as well as partners from industry, academia, and utilities. These efforts span critical materials discovery, energy systems modeling, grid modernization, advanced manufacturing, and other areas essential to strengthening U.S. energy security and competitiveness. Together, these collaborations produced 708 technical outputs, including 293 peer-reviewed publications, reflecting both the depth and impact of the science enabled by NLR's computing capabilities. This year's report highlights the growing importance and benefit of AI throughout NLR's research programs and features work by early career researchers who are helping shape the future of computing-enabled energy innovation. Explore these sections and the many project successes captured in the pages that follow.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014

The Cyber Attack on Thyssenkrupp Blast Furnace 2014 Precursor Analysis Report leverages publicly available information about the Thyssenkrupp Steel Mill cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In December 2014, the German Government’s Federal Office for Information Security (BSI) released a report detailing a cyber attack on a German steel mill that occurred earlier that year, though exact dates and details of the attack were not revealed. While the report did not specify the name of the company, multiple sources identified the victim as one of Europe’s largest steel manufacturers, Thyssenkrupp AG. Further, Thyssenkrupp announced on 16 May of that year that Europe’s largest blast furnace, “Schwelgern 2,” located at its facility in Duisburg, Germany, would be offline for several weeks for repairs and upgrades, suggesting Schwelgern 2 was likely the target of the attack. The attack began in early 2014, when adversaries infiltrated the victim steel mill’s Information Technology (IT) network via a spearphishing campaign, then worked their way into the Operational Technology (OT) environment, where they executed software that caused denial of service, denial of control, and eventually a loss of control. This led to the blast furnace shutting down without proper safety procedures, resulting in catastrophic physical damage. No lives were lost in the incident, but ThyssenKrupp suffered $4 million in damage to the blast furnace and an additional $6 million in lost revenue. The adversaries required specialized knowledge and expertise in steel production, which enabled them to compromise a variety of internal systems and components across both IT and OT networks. The attack also demonstrated detailed knowledge of the industrial control systems (ICS) and production processes being used. This combination resulted in one of the earliest known publicly reported cybersecurity incidents resulting in physical damage to ICS equipment. Researchers and analysts identified 19 unique techniques (used in a sequence of 20 steps) utilized during the attack with a total of 454 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the Thyssenkrupp cyber attack were precursors to the triggering event. Analysis identified 369 observables associated with these precursor techniques, 316 of which were assessed to have an increased likelihood of being perceived in the 120 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Remote Access Attack on Oldsmar Water Treatment Facility 2021

The Remote Access Attack on Oldsmar Water Treatment Facility 2021 Precursor Analysis Report leverages publicly available information about the Oldsmar cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 5 February 2021, an adversary gained unauthorized remote access to Bruce T. Haddock Water Treatment Plant in Oldsmar, Florida, which provides treated water to 15,000 customers. The adversary accessed the facility’s Supervisory Control and Data Acquisition (SCADA) workstation and human machine interface (HMI) to change the chemical concentration of sodium hydroxide, commonly referred to as lye and used to regulate acidity levels, from 100 parts per million (PPM) to 11,100 PPM. The chemical was raised to lethal levels that if ingested could lead to serious soft tissue damage, burns, or even death. The facility, however, had redundancies and alarms in place to alert personnel of dangerous chemical levels, and facility officials stated it would have taken 24 to 36 hours for the chemical changes to affect the water supply. Researchers and analysts identified six unique techniques utilized during the attack with a total of 23 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Four of the identified techniques used during the Oldsmar cyber attack were precursors to the triggering event. Analysis identified 21 observables associated with these precursor techniques, 20 of which were assessed to have an increased likelihood of being perceived in the minutes preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2026

Carbon Capture on Air Liquide United States Gulf Coast Steam Methane Reformer using the Cryocap TM Flue Gases Process

The objective of this DOE-funded project is to execute and complete a Front-End Engineering and Design (FEED) study for a commercial-scale carbon capture project for Air Liquide’s Steam Methane Reformer (SMR) located at La Porte, near Houston, Texas. The Host Site is one of Air Liquide’s largest SMR assets, and supplies hydrogen to the Air Liquide Gulf Coast Hydrogen System, which serves refiners and petrochemical manufacturers through an existing H2 pipeline spanning roughly 200 miles from Port Arthur, TX to Bay City, TX. The Host Site produces up to 116.5 million standard cubic feet per day (MMSCFD) of gaseous hydrogen and emits approximately 950 ktpy CO 2 at the nameplate capacity. The evolving importance of decarbonized H2 for both existing customers and new markets, as well as the availability and intent of prominent third-party partners to transport and sequester captured CO 2 in locally abundant geological sites for 45Q credits, make the AL US Gulf Coast SMR an ideal site for the proposed FEED study. The envisioned carbon capture system is based on Air Liquide’s proprietary Cryocap™ Flue Gas (FG) process. The integration of the Cryocap™ FG technology to the existing SMR would enable the capture of 900 ktpy of CO 2 , with a net carbon capture rate of >95% and with minimum impact on the levelized cost of hydrogen produced at 99.97% purity.

03 NATURAL GAS↗
DOE OSTI2026

Electric Utility Distribution Costs: Scoping Study on Trends, Drivers, and Possible Response Strategies [Slides]

This scoping study synthesizes information that will help stakeholders understand the scope, scale, and drivers of recent increases in investor-owned utility (IOU) expenditures on local distribution power grids, while providing regulators and other decision-makers with potential strategies to keep electricity bills down. The study includes five distinct components. Drawing first on data from FERC Form 1, it summarizes key trends in past and recent IOU distribution costs. Next, through a review of a sample of distribution-system plans, it characterizes material drivers of planned distribution expenditures. Ultimately, regulators must approve cost recovery for IOU expenditures, including those for the distribution system. The study therefore also: examines trends in utility requests and regulatory approvals related to changes in retail rates and return on equity; identifies areas where utility shareholder and customer incentives may be misaligned; and develops a menu of options that state regulators might consider to optimize distribution system expenditures. Some of the key findings include: - IOU distribution spending at a national level has grown by 6%/yr since 2014 in real dollar terms, 4x faster than in the prior 20 years and consisting mostly of capital (not operating) expenditure. - On a per-kWh basis, increases in IOU distribution costs since 2014 represent over 30% of the overall national-average increase in retail electricity rates. - Regional spending growth has ranged from 2-8%/yr, with larger estimated rate impacts in CAISO, then NYISO & ISO-NE, and then the Southeast, MISO & PJM (see figure). - Some utilities are planning for significantly increased distribution system spending. Planned spending on managing the existing system (asset replacement, safety & reliability, and resilience are all important drivers) exceeds that for capacity expansion. - IOU rate increase requests ($18 billion in 2025) and public utility commission (PUC) approval levels (average of 64% of requested amounts from 2021-2025) have recently hit multi-decadal highs. - PUCs in New England and the Southeast have recently approved a greater fraction of rate requests (>75%, on average) than in ther regions, while PUCs in California and the Southeast have generally authorized higher equity returns than in other regions. - Regulators have many tools to tackle potential misalignments between utility and customer interests and, more specifically, to optimize and reduce distribution costs. Shorter-term options include those related to return on equity, capital structure, depreciation, trackers, construction work in progress, and securitization. Longer-term options include performance-based regulation and a wide variety of planning-related requirements. All options embed important tradeoffs.

24 POWER TRANSMISSION AND DISTRIBUTION↗