Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “SUBSTATIONS”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8
All sourcesNASA NTRSDOE OSTI
DOE OSTI2018

Multi-Timescale Three-Phase Unbalanced Distribution System Operation With Variable Renewable Generations

This paper proposes a multi-timescale operational approach for a three-phase unbalanced distribution system, which contains hourly scheduling at substation level and minutes power flow operation at feeder level. In the substation scheduling model, the objective is to minimize the system cost with variable renewable generations. The given error distribution model of renewable generation is formulated as a chance constraint, and derived into a deterministic form by Gaussian mixture model (GMM) with genetic algorithm-based expectation-maximization (GAEM). In the feeder scheduling model, the system cost is further reduced with the optimal power flow (OPF) at a timescale of minutes. Considering the nonconvexity of the three-phase unbalanced OPF problem in distribution systems, the semidefinite programming (SDP) is used to relax the problem into a convex problem, and a distributed computation approach is built based on alternating direction method of multiplier (ADMM). The IEEE 123-bus distribution system, DU (University of Denver) campus distribution system, and the IEEE 8500-bus distribution system are used as the test bench for the proposed approach. And the numerical results demonstrate the effectiveness and validity of the proposed method.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2014

Integrated, Automated Distributed Generation Technologies Demonstration

The purpose of the NETL Project was to develop a diverse combination of distributed renewable generation technologies and controls and demonstrate how the renewable generation could help manage substation peak demand at the ATK Promontory plant site. The Promontory plant site is located in the northwestern Utah desert approximately 25 miles west of Brigham City, Utah. The plant encompasses 20,000 acres and has over 500 buildings. The ATK Promontory plant primarily manufactures solid propellant rocket motors for both commercial and government launch systems. The original project objectives focused on distributed generation; a 100 kW (kilowatt) wind turbine, a 100 kW new technology waste heat generation unit, a 500 kW energy storage system, and an intelligent system-wide automation system to monitor and control the renewable energy devices then release the stored energy during the peak demand time. The original goal was to reduce peak demand from the electrical utility company, Rocky Mountain Power (RMP), by 3.4%. For a period of time we also sought to integrate our energy storage requirements with a flywheel storage system (500 kW) proposed for the Promontory/RMP Substation. Ultimately the flywheel storage system could not meet our project timetable, so the storage requirement was switched to a battery storage system (300 kW.) A secondary objective was to design/install a bi-directional customer/utility gateway application for real-time visibility and communications between RMP, and ATK. This objective was not achieved because of technical issues with RMP, ATK Information Technology Department’s stringent requirements based on being a rocket motor manufacturing facility, and budget constraints. Of the original objectives, the following were achieved: • Installation of a 100 kW wind turbine. • Installation of a 300 kW battery storage system. • Integrated control system installed to offset electrical demand by releasing stored energy from renewable sources during peak hours of the day. Control system also monitors the wind turbine and battery storage system health, power output, and issues critical alarms. Of the original objectives, the following were not achieved: • 100 kW new technology waste heat generation unit. • Bi-directional customer/utility gateway for real time visibility and communications between RMP and ATK. • 3.4% reduction in peak demand. 1.7% reduction in peak demand was realized instead.

17 WIND ENERGY↗
DOE OSTI2015

Power grid reliability and security

This project has led to the development of a real-time simulation platform for electric power grids called Grid Simulator or GridSim for simulating the dynamic and information network interactions of large- scale power systems. The platform consists of physical models of power system components including synchronous generators, loads and control, which are simulated using a modified commercial power simulator namely Transient Stability Analysis Tool (TSAT) [1] together with data cleanup components, as well as an emulated substation level and wide-area power analysis components. The platform also includes realistic representations of communication network middleware that can emulate the real-time information flow back and forth between substations and control centers in wide-area power systems. The platform has been validated on a realistic 6000-bus model of the western American power system. The simulator GridSim developed in this project is the first of its kind in its ability to simulate real-time response of large-scale power grids, and serves as a cost effective real-time stability and control simulation platform for power industry.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2017

Renewable Energy Zones for Balancing Siting Trade-offs in India

India’s targets of 175 GW of renewable energy capacity by 2022, and 40% generation capacity from non-fossil fuel sources by 2030 will require a rapid and dramatic increase in solar and wind capacity deployment and overcoming its associated economic, siting, and power system challenges. The objective of this study was to spatially identify the amount and quality of wind and utility-scale solar resource potential in India, and the possible siting-related constraints and opportunities for development of renewable resources. Using the Multi-criteria Analysis for Planning Renewable Energy (MapRE) methodological framework, we estimated several criteria valuable for the selection of sites for development for each identified potential "zone", such as the levelized cost of electricity, distance to nearest substation, capacity value (or the temporal matching of renewable energy generation to demand), and the type of land cover. We find that high quality resources are spatially heterogeneous across India, with most wind and solar resources concentrated in the southern and western states, and the northern state of Rajasthan. Assuming India's Central Electricity Regulatory Commission's norms, we find that the range of levelized costs of generation of wind and solar PV resources overlap, but concentrated solar power (CSP) resources can be approximately twice as expensive. Further, the levelized costs of generation vary much more across wind zones than those across solar zones because of greater heterogeneity in the quality of wind resources compared to that of solar resources. When considering transmission accessibility, we find that about half of all wind zones (47%) and two-thirds of all solar PV zones (66%) are more than 25 km from existing 220 kV and above substations, suggesting potential constraints in access to high voltage transmission infrastructure and opportunities for preemptive transmission planning to scale up RE development. Additionally and importantly, we find that about 84% of all wind zones are on agricultural land, which provide opportunities for multiple-uses of land but may also impose constraints on land availability. We find that only 29% of suitable solar PV sites and 15% of CSP sites are within 10 km of a surface water body suggesting water availability as a significant siting constraint for solar plants. Availability of groundwater resources was not analyzed as part of this study. Lastly, given the possible economic benefits of transmission extensions or upgrades that serve both wind and solar generators, we quantified the co-location opportunities between the two technologies and find that about a quarter (28%) of all solar PV zones overlap with wind zones. Using the planning tools made available as part of this study, these multiple siting constraints and opportunities can be systematically compared and weighted to prioritize development that achieves a particular technology target. Our results are limited by the uncertainties associated with the input datasets, in particular the geospatial wind and solar resource, transmission, and land use land cover datasets. As input datasets get updated and improved, the methodology and tools developed through this study can be easily adapted and applied to these new datasets to improve upon the results presented in this study. India is on a path to significantly decarbonize its electricity grid through wind and solar development. A stakeholder-driven, systematic, and integrated planning approach using data and tools such as those highlighted in this study is essential to not only meet the country's RE targets, but to meet them in a cost-effective, and socially and environmentally sustainable way.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2017

Lessons Learned "Establishing an Electrically Safe Work Condition" Specifically related to Racking Electrical Breakers

During low voltage electrical equipment maintenance, a bad breaker was identified. The breaker was racked out from the substation cubicle without following the hazardous energy control process identified in the Integrated Work Document (IWD). The IWD required the substation to be in an electrically safe work condition prior to racking the breaker. Per NFPA 70E requirements, electrical equipment shall be put into an electrically safe work condition before an employee performs work on or interacts with equipment in a manner that increases the likelihood of creating an arc flash. Racking in or out a breaker on an energized bus may increase the likelihood of creating an arc flash dependent on equipment conditions. A thorough risk assessment must be performed prior to performing such a task. The risk assessment determines the risk control measures to be put in place prior to performing the work. Electrical Safety Officers (ESO) can assist in performing risk assessments and incorporating risk control measures.

30 DIRECT ENERGY CONVERSION↗
DOE OSTI2018

Transactive System Program Communication System Cost Model

Transactive energy is an economics and controls technique that aims to dynamically manage the generation and consumption of electricity within the power system. Much research has been done in the area of demonstrating the capability and performance of transactive systems, as well as valuing the benefits a transactive system can provide. Significantly less research has been done in the area of estimating the costs of a transactive system. This work aimed to build a model that would estimate the costs of the communications system that would be necessary to support a transactive system and be realized by a local utility. Dynamic pricing, and a customer’s response to this pricing, is a key aspect of a transactive system; this would require a two-way communication system between utilities and customers. Since the system will vary based on many factors, the cost model was consequently designed for use in a wide variety of applications. The cost model requires some basic user inputs regarding the system being analyzed, such as location and size. The user also identifies one or more generic circuit models that best represent the system. Additionally, a user can, but is not required to, change assumed equipment and installation costs and equipment lifetime within the model. These inputs will result in 20 year cost estimates for three different communication technologies that are capable of supporting the bandwidth needs of a transactive energy system. The three communication systems included in the model are cellular, fiber optic and wireless mesh. Each vary significantly from one another and offer unique advantages and barriers. A cellular network avoids high upfront costs, but is limited to areas where there is coverage by the service provider and subject to the ongoing rate established with the service provider. A fiber optic system requires a large up-front cost, but it will provide a reliable system to areas where cellular and mesh may be unable to do so. Additionally, fiber provides more bandwidth than necessary for transactive systems and can offer additional business opportunities. A mesh system can be installed for less upfront costs than fiber and offers enough bandwidth to support a transactive system, but the ability to model this technology is done with less certainty than the other two options. The estimated costs include the communication system that connects the customers to their nearest substation, in addition to the smart meter and radio that would be required for each customer. The communications from the substation to the utility are not included in estimates, as the need for upgrading that system would be assessed on a case-by-case basis. Although the cost of the smart meter and radio is included, no other appliance specific cost is included in the estimate provided by the model. The communication system is a key aspect of the development of a transactive system. This work resulted in easily being able to estimate the costs of a communication system specific to the system being studied. This cost model will aid ongoing valuation and simulation work in the field of transactive energy.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2017

Applied Resiliency for More Trustworthy Grid Operation (ARMORE) (Final Technical Report)

Applied Resiliency for More Trustworthy Grid Operation (ARMORE) is an open-source software system that can perform inspection of network packets and alarm on communication that does not comply with the specified ARMORE policy. ARMORE can be configured to take action to block network traffic based on deep inspection of common substation communications protocols, such as the Distributed Network Protocol (DNP3). After validation for compliance with policy, ARMORE can encapsulate and encrypt legacy communications and resiliently transmit this information among ARMORE nodes (such as between the substation and the control center). Through this peer-based framework for secure information exchange, ARMORE provides the functionality to push secure, fault-tolerant real-time communication capabilities deeper into critical utility networks

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2019

Alliance Project: Secure Control Systems for the Energy Sector

The Alliance Project addresses Area of Interest 4: Secure Remote Access for the Energy Sector, by combining physical and cyber access under one cybersecurity access system. The Alliance Project built on the successful completion of the Lemnos and Padlock Project (DOE-Funded Project started in 2007 and 2010) and researched and developed a solution for an Ethernet Security Gateway with the functionality required to integrate the physical access control cyber system and interface with legacy and new proximity card readers used for physical access requests. This project focused on securing and enhancing the cyber system the physical access control system operates on. The team tested and demonstrated the system solution on the SEL campus. Currently the physical access cyber system is completely separate from the cyber access control cyber system. With a single system industry benefits include: (1) Single system to learn and teach employees; (2) Single system that collects and alerts on logs and events simplifying incident response plans and NERC CIP compliance; (3) Unifies trust management to a single system reducing the potential errors in privilege escalation or revocation; (4) Provides a stronger cybersecurity platform the physical access control system operates on. Today they are mostly plain text protocols and little cyber awareness; (5) Integration of physical access awareness allows the cyber system to react and adjust. In some cases, the cyber access can be enhanced with authorized physical access and other cases the cyber access can be more restricted with unauthorized physical access; and (6) Enables the utility to establish as large or as small a physical access control system as they require. One example would be when a utility shares a substation with a neighbor utility and can’t rely on the substation door for the physical access control. The Alliance technology enables them to lock equipment racks simply with no scalability issues because it stands on the cyber security infrastructure which is already highly scalable.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Effect of GPS Manipulation to Traditional and Next Generation Relay Protection

This project’s objective is to test the effect of GPS timing variations on relay protection algorithms to determine vulnerabilities and the associated hazards to the electric grid. This will focus on differential protection which utilizes peer to peer communication between substations to determine if the current is not equivalent. This requires the use of GPS to sync the two substations and can be vulnerable to GPS manipulation. However, the effects of GPS manipulation are not a commonly known risk. Therefore, this LDRD will address the risks of GPS manipulation for such a widely implemented technology. For differential protection a GPS resilient architecture was implemented and tested for differential protective relays through a direct serial fiber connection between the two relays. This allows for one relay to be the master and provide synchronization outside of timestamp for differential protection.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Broadband Characterization and Circuit Model Development of Transmission-Scale Transformers

This report describes broadband measurements of transmission-scale transformers typical in the electric power grid. This work was performed as part of the EMP Resilient Grid LDRD project at Sandia National Laboratories to generate circuit models that can be used for high-altitude electromagnetic pulse (HEMP) coupling simulations and response predictions. The objective of the work was to obtain characterization data of substation yard equipment across a frequency range relevant to HEMP. Vector network analyzer measurements up to 100 MHz were performed on two power transformers at ABB-Hitachi and a single ITEC potential transformer. Custom cable breakouts were designed to interface with the transformer terminals and provide ground connections to the chassis at the base of the transformer bushings. The three-phase terminals of the power transformers were measured as a common mode impedance using a parallel resistive splitter, and the single-phase terminals of the potential transformer were measured directly. A vector fitting algorithm was used to empirically fit circuit models to the resulting two-port networks and input impedances of the measured objects. Simplified circuit representations of the input impedances were also generated to assess the degree of precision needed for high-altitude electromagnetic pulse response predictions, which were performed in Sandia's XYCE circuit simulator platform. HEMP coupling simulations using the transformer models showed significant reduction in the voltage peak and broadening in the pulse width seen at the power transformer compared to the traveling wave voltage. This indicated the importance of the load condition when defining the coupled insult in an electric power substation. Simplified circuit models showed a similar voltage at the transformer with a smoothed waveform. The presence of potential transformers in the simulation did not significantly change the simulated voltage at the power transformer. Single-port input impedance models were also developed to define load conditions when transfer characteristics were not necessary.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Fork Union EPC Installation Observation Report

On June 22nd and 23rd, a representative from Savannah River National Lab (SRNL) traveled to the Fork Union substation in Fork Union, Virginia (owned and operated by Dominion Energy) to observe the installation, calibration, and commissioning of three Electric Phenomena Cluster (EPC) sensors. The installation in its entirety included the physical securing of the EPC sensors by Dominion Energy, fiber optic cable (furnished by SmartSenseComm) being run in conduits and cable trays from the EPC sensor to the Optical Processing Unit (OPU) located in the substation switch house. The location of the EPC sensors, OPU, and cable routing can be seen in the figures included.

47 OTHER INSTRUMENTATION↗
DOE OSTI2022

Cyber Resilient Flexible Alternating Current Transmission Systems (XFACTS)

This report summarizes the activities conducted under the DOE-OE funded project DEOE0000897, Cyber Attack Resilient Flexible AC Systems – XFACTS. Hitachi Energy (HE), in collaboration with ABB Inc. (ABB), Bonneville Power Administration (BPA), University of Illinois at Urbana-Champaign (UIUC), Iowa State University (ISU), and University of Idaho (UI) pursued the development of a system of defense for Flexible Alternating current Transmission Systems against cyber-attacks (XFACTS). A FACTS substation enhanced with XFACTS defense mechanisms will be capable of mitigating cyberattacks especially those that seek to control electrical parameters like voltage or current and interrupt the power flow in AC lines. It empowers existing FACTS controllers and associated intelligent electronic devices to detect and mitigate malicious intents to depress system voltages, destabilize power flows, trip AC circuit breakers, corrupt currents, and voltages, even if the malicious commands and the measurements have correct syntax. The XFACTS functions utilize the physics of active power electronic systems, control and protection, electric power engineering principles, and state estimation to bring more in-depth cyber defense closer to the protected FACTS substation devices.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

California Energy Systems for the 21st Century (CES-21) Program, CRADA TC02200 (Final Report)

The following report representsthe culmination of a five-year Cybersecurity Research and Development (R&D) program performed by California’s Investor-Owned Utilities (IOUs) and Lawrence Livermore National Laboratory (LLNL) and funded by the IOUs’ electricity ratepayers as authorized by California Legislation and the California Public Utilities Commission (CPUC). The cybersecurity R&D, which was intensely technical in nature, was broken into three major workstreams: 1. The development of a modeling & simulation platform, to explore the potential effects of various threat and response scenarios at grid scale; 2. The establishment of a physical testbed with separate substation instances from each of the IOUs, to evaluate threats and responses on actual substation equipment; 3. The development of a research package consisting of several capabilities to support the industry’s evolution towards automated threat response and other next-generation cybersecurity techniques Throughout the program, there was extensive collaboration between the program team and national laboratories, federal departments, academic institutions and industry organizations. Several of the tools developed through the program have been made available to the open source community, to enable faster adoption and continued development of important cybersecurity capabilities. While this program began to develop much of the foundation for automated threat response, much work remains to be done, and this report recommends a series of next steps. While the Executive Summary below has been simplified as much as possible, the very technical nature of the subject matter would make further reduction difficult without causing meaning to be lost. Due to the sensitive nature of the research, some topics are intentionally covered at a high level to protect the research and therefore the electric grid and customers of California and the Nation. For further detail, clarification or questions we suggest discussion with the program team.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2023

Electrical Fault Detection, Power Quality, Distributed Energy Resource Use Cases, and Cyber Event Applications with the Cyber Grid Guard System Using Distributed Ledger Technology

Electrical utilities continue to deploy more intelligent electronic devices (IEDs) inside and outside electrical substation and are associated with distributed energy resources (DERs). The integrity and confidentiality of data from IEDs is crucial, and distributed ledger technology (DLT) could improve the resilience of microgrids by helping to make these data more secure. The most popular applications using blockchain technology for electrical utilities is in the field is based on energy trading. However, the dynamism of the penetration of customer owned DERs and the deployment of sensors with IEDs have led to the identification of new applications using DLT that are focused on other areas, such as monitoring, operation and management of the grid and its assets. In addition, the majority of studies on electrical grid applications with blockchain were validated with software simulations. Although general monitoring of power systems for using DLT could be evaluated in operational electric grids, other DLT research applications such as defense against cyber-attacks and/or electrical fault detection are not likely to be performed in a real infrastructure because of possible risks to the network/equipment security. This report summarizes the application of power system applications using distributed ledger technology (DLT), providing a secure DLT framework for collecting data from IEDs like power meters and protective relays inside and outside of an electrical substation and/or between two different electrical utilities. In this study, the use case scenarios were created and assessed for different power system application by using DLT. The electrical fault detection for faulted phases (1), power quality monitoring of phase voltage magnitudes, frequency levels and load power factor (2), DERs use case monitoring (3), and cyber-event applications (4) were performed in a test bed with a Cyber-Grid Guard (CGG) system using DLT. It had a real-time simulator with power meters and protective relays in-the-loop. The first section of this report presents a literature review of power system applications using blockchain at research level. The second section shows the theory and equations used on this report. The third section shows the description of the test bed, equipment, architecture, and electrical grid diagrams. The fourth section shows the experimental models and use case scenarios that were performed for the electrical fault detection, power quality, DERs use case, and cyber event applications with the CGG system using DLT. The fifth section shows the results collected from the tests based on comparing the time stamped events of the analog signals from the IEDs, DLT computer and real time simulator. The sixth section performed the discussion of the results for the use case scenarios. Finally, section seven presents the conclusions for this report were presented.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Seasonal Cost-Benefit Analysis of Automated Distribution Feeder Upgrades with Advanced Mitigation Technologies

The increasing deployment of distributed solar photovoltaics (DPV) to meet clean energy goals can trigger adverse grid operation issues, such as voltage excursions and the violation of thermal loading constraints of the power delivery elements (e.g., lines and transformers) on the evolving electricity infrastructure. Such integration issues would require distribution upgrades with associated costs to mitigate them and to maintain reliable and resilient grid operating conditions. Traditional distribution network upgrade approaches use a specific single snapshot analysis that is overly conservative. This study considers a multi-time point analysis to capture both moderate (probable bounds) and extreme grid operating conditions using time points such as minimum load with minimum photovoltaics (PV), maximum load with maximum PV, maximum load with minimum PV, and minimum load with maximum PV. Further, this study investigates seasonal variation impacts and associated distribution upgrade costs for a spring season case (March, representing a low load and high PV scenario) and a summer case (July, representing a high load and high PV scenario). Such seasonal analysis will allow system operators to characterize upgrade requirements and associated costs across various periods. Because the spatial distribution of DPV can impact upgrade and associated costs, this study investigates three common DPV deployment scenarios - randomly deployed, close to the substation, and far from the substation - at different penetration levels. Apart from spatial distribution impacts, this project evaluates the techno-economic impacts of the nodal photovoltaic penetration factor (NPPF) for generating the various DPV deployment scenarios at increasing penetration levels. This project investigates the impact of varying nodal PV-to-load ratios using conservative and extreme NPPF values of 3 and 10, respectively. This study investigates the deployment of traditional infrastructure upgrade strategies, such as installing new voltage regulating equipment, transformers and lines replacements, and the activation of advanced inverter functionality (e.g., autonomous volt/VAR) in expanding PV hosting capacity. Existing DPV systems are assumed to operate with the legacy unity power factor, and we considered the possibility of retrofitting such systems with the activation of volt/VAR control as integration standards and regulations continue to evolve to allow such functions. The cost-benefit analysis metrics used in study include distribution upgrade costs, average cost per watt of the upgrade cost, average marginal cost per watt of the upgrade cost, and power losses.

14 SOLAR ENERGY↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗