Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “likelihood”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,477 records · Page 82
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Sovereign Credit Rating Processes Adapted to Critical Infrastructure Cyber Risk Assessment

United States critical infrastructure entities are increasingly targeted by motivated and capable threat actors and must be prepared to assess and treat a diverse range of cyber risks. Consequently, this necessitates some form of analytical process to evaluate risks and inform cyber security investment decisions. A potential solution for structuring cyber risk evaluation exists within the field of sovereign credit ratings – where agencies employ mature approaches that integrate quantitative and qualitative data to produce a singular value of assessment. Adapting such approaches, we present a novel criterion and methodology for measuring and communicating the likelihood element of cyber risk. The methodology is composed of three sequential phases: a quantitative baseline organized by distinct capability frames, a bounded qualitative adjustment per frame, and a greater-bounded qualitative adjustment spanning the entire process. The process culminates in publication of a cyber capability rating that communicates a critical infrastructure entity’s ability and willingness to mitigate discontinuous function due to cyberattack.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Identification of Faults Susceptible to Induced Seismicity (Final Report)

Central to the work documented in this report is the capability of geocellular models to represent the geologic conceptual model updated with fault identification from machine learning and joint inversion modeling of microseismic data measured and recorded as a consequence of CO 2 injection at a field demonstration site: the Illinois Basin - Decatur Project (IBDP). This work required seven unique geocellular models with 100s of simulated variations to gain a very high degree of confidence in the identification of geologic features present that contributed to induced microseismicity at IBDP. All forward modeling: pressure modeling, stress modeling, and seismic modeling used the same geologic conceptual model and representations of that model at different scales. The pressure modeling and poroelastic modeling created “snapshots” of pore pressure and stress field changes at different times during CO 2 injection, in which microseismic events were clustered (in time). These pressure and stress snapshots, within the framework and architecture of the geologic conceptual model via the geocellular model, informed the single fault and fault network models to ascertain the likelihood of fault movement (seismic or aseismic). The outcomes of the pressure, stress, and fault/fault network (seismic) modeling confirmed that the faults in the geologic conceptual model in Task 2 were likely the source of microseismic events measured at IBDP and acted as conduits for pressure to be transmitted from the injection interval into the Precambrian crystalline basement rock. This closely coordinated and integrated unique modeling approach was conducted to prove the viability of our proposed workflow 1) to better resolve crystalline basement faults, 2) detect subseismic faults that could be activated by injection, 3) increase the certainty in fault detection and their susceptibility to release seismic energy, and 4) understand transmission of pressure vertically from the well to the underlying fractured crystalline basement. The proposed methodology was effective in guiding an iterative process of calibrating forward modeling results based on similar geocellular models while honoring the geologic conceptual model (i.e., characterization data and knowledge of regional geology); this led to higher level of certainty in the identification of fault/faults zones to control seismicity and transmission of pressure to the regions of recorded and located injection induced seismicity.

58 GEOSCIENCES↗
DOE OSTI2025

Expansion of the Direct Feed High-Level Waste Glass Composition in the High Al Range

Baseline glass compositions have been developed and demonstrated for successful immobilization of Hanford high-level waste (HLW) prepared through a pretreatment process. Recent enhanced waste glass formulations have shown promise to increase the waste loading of pretreated sludge compositions from a broader range of HLW feeds. This project proposes to increase the loading of minimally pretreated Hanford HLW in glass by expanding the existing database and glass property-composition models. Estimated direct-feed high level waste (DFHLW) compositions were generated by the Hanford Tank Operations Contractor and used by Pacific Northwest National Laboratory to determine target glass compositions. Gaps in existing data were identified including one high-priority gap in the high Al compositional region. This report summarizes the data collected during the characterization of the DFHLW High Al Glass Matrix. These glasses were intentionally designed with high aluminum concentrations (15 to 30 wt%) and a high likelihood of nepheline formation, which is known to negatively affect glass durability. Some glasses were expected to either fail or approach property constraints to fill data gaps in poorly understood regions of the compositional space due to lack of data. Out of the 50 glasses tested, 14 glasses formed nepheline, while the model predicted nepheline formation in 20 glasses. All quenched glasses met the product consistency test durability constraint; however, 8 glasses failed this constraint after undergoing the canister centerline cooling treatment. Additionally, 17 glasses did not meet the viscosity constraints, 4 failed the EC constraints, and 2 exceeded the allowable T2% for spinel crystal formation. All glasses satisfied the SO 3 solubility limit. The resulting dataset provides valuable information to improve model accuracy and reduce prediction uncertainty. These insights will ultimately support the development of more robust glass formulation strategies, enabling higher waste loadings, reducing operational risks, and expanding the processing envelope.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2025

Near-Efficient and Non-Asymptotic Multiway Inference

We establish non-asymptotic efficiency guarantees for tensor decomposition–based inference in count data models. Under a Poisson framework, we consider two related goals: (i) parametric inference , the estimation of the full distributional parameter tensor, and (ii) multiway analysis , the recovery of its canonical polyadic (CP) decomposition factors. Our main result shows that in the rank-one setting, a rank-constrained maximum-likelihood estimator achieves multiway analysis with variance matching the Cramér–Rao Lower Bound (CRLB) up to absolute constants and logarithmic factors. This provides a general framework for studying “near-efficient” multiway estimators in finite-sample settings. For higher ranks, we illustrate that our multiway estimator may not attain the CRLB; nevertheless, CP-based parametric inference remains nearly minimax optimal, with error bounds that improve on prior work by offering more favorable dependence on the CP rank. Numerical experiments corroborate near-efficiency in the rank-one case and highlight the efficiency gap in higher-rank scenarios.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

The Effect of Luminance Pattern on Nighttime Discomfort Glare Response (CRADA Final Report)

LED luminaires with apertures containing visually resolvable “bright” (i.e., high luminance) spots are commonly used to illuminate outdoor environments. However, the impact of the distance between LEDs, which determines spatial frequency at a given viewing distance, on perceived discomfort caused by these luminaires remains unclear. This study involved 29 participants who were each shown 68 stimuli varying in spatial frequency, intensity, diffusion level, and ambient lighting in a dark laboratory setting. Participants reported their experiences of discomfort from glare, ability to resolve individual LEDs, and afterimages. The findings revealed that increased spatial frequency heightened both discomfort and the likelihood of experiencing afterimages. It is hypothesized that the point spread function of the eye contributed to these effects, where sources began to be perceived as a single larger source with equal or greater intensity. These results suggest that LED luminaire designs should favor configurations with lower spatial frequencies to minimize discomfort. A simple quantity, direct illuminance at the eye, is recommended for use to predict discomfort from glare because it performed like other more complex models.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2025

Evaluating the feasibility of tidal energy extraction at non-operational gas platforms and effects of sedimentation and sea ice in Cook Inlet (Abstract)

Littoral Power Systems (LPS) has been granted a FERC preliminary permit for the Upper Cook Inlet Tidal Energy Project in an area that includes existing non-producing natural gas platforms. LPS is working to understand the feasibility of a 2 MW tidal energy project and is considering multiple technologies, the viability of using the platforms to support deployment and operation of the technologies, as well as the environmental conditions that will interact with tidal energy devices. The proposed TEAMER work will conduct a modeling study to understand 1) current velocity and turbulence; 2) the distribution of sea ice trajectories around the platform; and 3) the likelihood of seabed erosion and deposition through an analysis of shear stress in the seabed near the platforms. The results of this work will contribute to determining the feasibility of the site for tidal energy development.

16 TIDAL AND WAVE POWER↗
DOE OSTI2024

An Assessment of the Safeguards Implications of Particle and Alloy Formation in MSRs

Molten salt reactors (MSRs) present unique challenges for applying safeguards measures and differ significantly from traditional nuclear reactors. Although the special fissionable materials within MSRs principally exist as dissolved species within the fuel salt, key actinides of interest may also be converted to solid phases including alloys and precipitated oxides via chemical and electrochemical reactions. These solid-phase components will complicate the nuclear material accounting and control (NMAC) approaches that have, so far, primarily targeted measurements of the liquid salt itself. For example, most of the proposed monitoring and characterization methods for MSRs are reliant on homogeneity of the salt and the ability to maintain accountable materials in solution. Solid deposits and particulates could invalidate the assumption of homogeneity and necessitate the use of new models and measurement tools to permit a full accounting of all nuclear material in an MSR. To address this, the likelihood of solids formation in MSRs, estimated the rate at which these solids could form, and assessed the monitoring tools that are available to account for the presence of these materials were examined. Specifically, three solid forming mechanisms were investigated, including (1) the accumulation of actinides within the MSR’s structural materials due to alloying, (2) the accumulation of actinides within noble metal fission product particulates, and (3) the generation of actinide oxides from interactions with salt impurities. These modeling-informed studies were completed with considerations to both fluoride- and chloride-containing salts. It was determined that, although measurable amounts of special fissionable material were expected to alloy with the structural elements and fission products, the predicted amounts were below levels considered as significant quantities (SQ) by the International Atomic Energy Agency (IAEA). However, it was determined that sufficiently large oxygen concentrations could potentially lead to significant quantities of special fissionable material being converted to solid oxide phases. As such, a comparative study of technologies that are commercially available to assist in monitoring and accountancy of this material was presented. Policy implications, design recommendations, and suggestions for follow-on experimental work were also presented to further assist reactor vendors in designing and controlling the fuel salt chemistry to address potential safeguards considerations.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2026

Teleseismic Network Association with GENIE

In this report we investigate adapting the Graph Neural Interpretation Engine (GENIE), an associator developed for three-component dense monitoring networks, to regional to teleseismic association using a sparse network of array stations. We expand GENIE’s input features to include first-P detection time, azimuth, and slowness estimates. Additionally, we include a probability of detection (PDET) term which measures a station’s likelihood of detecting an event. To assess each feature’s relative importance, we train four models, each using an increasing set of node features and find that the PDET models perform the best. We define two measures of event complexity which demonstrate that all GENIE model versions perform better than the standard backprojection stack.

47 OTHER INSTRUMENTATION↗
DOE OSTI2025

DeepDiagnostics: A Software Package for Streamlined Posterior Evaluation

Automated prediction techniques like simulation-based inference (SBI) are important tasks for science experiments that produce large amounts of complex, raw data. However, their development remains in its early stages because the uncertainties of these techniques lack sufficient trustworthiness and interpretability. Packages for SBI provide a growing set of diagnostics; however, the software requirements are substantial, as they are tied to the inference technology itself, and the APIs lack adaptability. We introduce the DeepDiagnostics package for diagnosing posteriors from analytic likelihood-based methods and SBI methods, such as neural posterior estimation. DeepDiagnostics produces a comprehensive set of high-quality visualizations and metrics in a highly accessible, easy-to-use, and flexible package. We address all of these goals by providing a command-line inference tool and a Python API that is controlled through a configuration file. The package includes common diagnostics, such as parity plots, corner (covariance) plots, simulation-based calibration (SBC) diagnostics (including posterior coverage and rank histograms), Lemos et al. s PQMass and TARP, Masserano et al. s WALDO, Linhart et al. s LC2ST, as well as credible region diagnostics developed by our group.

Voetberg, Maggie [Fermilab]↗
DOE OSTI2026

Cooperative Agreement To Analyze variabiLity, change and predictabilitY in the earth SysTem (CATALYST)

CATALYST proposes to perform foundational coordinated research in a team-oriented collaborative effort aimed at advancing a robust understanding of modes of Earth system variability and change using models, observations and process studies. The proposed research will address the DOE/BER mission by exploring the limits to predictability, identifying fundamental underlying mechanisms, quantifying interactions among modes of variability, and discovering tipping points in the Earth system to understand the current and future impacts of these phenomena on regional and global climate. Four fundamental gaps are identified in our knowledge of the Earth system: 1) What are the limits to predictability on various timescales? 2) What are the interactions among modes of Earth system variability? 3) How may modes of Earth system variability change in response to changes in external forcing, and what are the tipping points involved with those changes? 4) How are high impact events connected to modes of Earth system variability and how may they change in the future? Related to those gaps in our knowledge, we formulate four research objectives to address those gaps using a combination of Earth system models (ESMs) and machine learning (ML) methods. Research Objective 1 (RO1) addresses the first gap above and proposes to understand modes of variability and their limits of predictability on subseasonal to decadal timescales using ESMs and ML. Research Objective 2 (RO2) addresses the second gap and proposes to use a hierarchy of models to understand relevant processes and feedbacks related to how modes of variability interact with each other. Research Objective 3 (RO3) is designed to study the third gap and proposes to examine the role of external forcings in changes of modes of Earth system variability and their interactions, and the likelihood and predictability of tipping points and irreversible changes. Research Objective 4 (RO4) will address the fourth gap and proposes to use high resolution ESMs, regionally refined models (RRMs), and ML methods to investigate the relationships between high impact events (e.g. flash droughts and precipitation extremes, atmospheric rivers (ARs), tropical cyclones (TCs), storm surge/sea level rise), the synoptic systems that produce them, and their changes related to modes of Earth system variability. The research will involve the use of the Community Earth System Model (CESM), Energy Exascale Earth System Model (E3SM), CMIP multi-model data sets, a hierarchy of simpler models, and numerous observational data sets. In the course of the proposed research, CATALYST will contribute to metrics and diagnostics that will be integrated in Coordinated Model Evaluation Capabilities (CMEC), particularly with regards to the Quasi-biennial Oscillation (QBO) and its interactions with the Madden-Julian Oscillation (MJO), high atmospheric pressure blocking, and new precipitation metrics.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2026

A Simulator for Neyer Tests of Explosives

Explosives and explosive devices such as detonators are typically tested by applying a range of stimuli such as voltage or mechanical shock, and recording binary “detonated/did not detonate” responses. These are analyzed using maximum likelihood or generalized linear models to provide estimates of quantities such as the all-fire and no-fire points. Given that the true threshold for detonation is unknown a priori , sequential design methods are typically used to optimize the set of test points. One popular method, implemented in commercial software, is Neyer’s algorithm. To support simulation and experimental design, we have developed code in the R programming language to duplicate the functions of the Neyer software. We provide code for the simulator along with a description and examples of usage.

42 ENGINEERING↗
DOE OSTI2026

Identification of Hydrogen Rail Maintenance Facility Hazards

Maintenance facilities for hydrogen rail, the activities conducted within such facilities, and how these activities differ from ordinary rail or hydrogen vehicle maintenance are currently being considered for the hazards specific to hydrogen. By performing a hazard and operability study (HAZOP) on numerous potential maintenance and repair scenarios, select low, medium, and high risk hazards relevant to hydrogen rail systems in such environments have been identified. The analysis resulted in 79 unique HAZOP scenarios: one scenario in the high risk category, 43 in the medium risk category, and 35 in the low risk category. Notably, large accidental releases of hydrogen due to tank rupture, aberrant defueling processes, or relief device opening within a facility are important low likelihood consequences that should nevertheless be appropriately prevented and mitigated.

08 HYDROGEN↗
DOE OSTI2026

Intrusive Uncertainty Quantification and Optimal Experiment Design in the Open-Source Pyomo Ecosystem

This contribution describes ParmEst and Pyomo.DoE, two pillars of the open-source Python-based Pyomo ecosystem for computational optimization with (partial differential) algebraic equation mathematical models. Specifically, ParmEst facilitates intrusive frequentist parameter estimation (PE) and uncertainty quantification (UQ) through built-in features, such as covariance matrix estimation, bootstrapping, and likelihood ratio tests. Complementary, Pyomo.DoE enables optimal experiment design by maximizing various metrics of the Fisher information matrix, such as A-optimality (trace), D-optimality (determinant), E-optimality (minimum eigenvalue), and ME-optimality (condition number). ParmEst and Pyomo.DoE can solve high-dimensional optimization problems by leveraging the model structure and exact derivative information. Finally, we will discuss future opportunities to integrate PE and UQ capabilities with optimization under uncertainty, including robust optimization with non-convex models via PyROS.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

Poisson-response Tensor-on-Tensor Regression and Applications

We introduce Poisson-response tensor-on-tensor regression (PToTR), a novel regression framework designed to handle tensor responses composed element-wise of random Poisson-distributed counts. Tensors, or multi-dimensional arrays, composed of counts are common data in fields such as inter national relations, social networks, epidemiology, and medical imaging, where events occur across multiple dimensions like time, location, and dyads. PToTR accommodates such tensor responses alongside tensor covariates, providing a versatile tool for multi dimensional data analysis. We propose algorithms for maximum likelihood estimation under a canonical polyadic (CP) structure on the regression coefficient tensor that satisfy the positivity of Poisson parameters and then provide an initial theoretical error analysis for PToTR estimators. We also demonstrate the utility of PToTR through three concrete applications: longitudinal data analysis of the Integrated Crisis Early Warning System database, positron emission tomography (PET) image reconstruction, and change-point detection of communication patterns in longitudinal dyadic data. These applications highlight the versatility of PToTR in addressing complex, structured count data across various domains.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗