Search NASA⌕ Search

SEARCH · Search NASA

Results for “precursor”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Boron nitride nanotube precursor formation during high-temperature synthesis: kinetic and thermodynamic modelling

In this work, we performed integrated modelling of the chemical pathways of formation for boron nitride nanotube (BNNT) precursors during high-temperature synthesis in a B/N 2 mixture. Integrated modelling includes quantum chemistry, Quantum–classical molecular dynamics, thermodynamic modelling, and kinetic approaches. We demonstrate that BN compounds are formed via the interaction of molecular nitrogen with small boron clusters, rather than through interactions with less reactive liquid boron. (This process can also be described as N 2 molecule fixation.) Liquid boron evaporates to produce these boron clusters (B m with m ≤ 5), which are subsequently converted into B m N n chains. The production of such chains is crucial to the growth of BNNTs because these chains form the building blocks of bigger and longer BN chains and rings, which are in turn the building blocks of fullborenes and BNNTs. Additionally, kinetic modelling revealed that B 4 N 4 and B 5 N 4 species in particular play a major role in the N 2 molecule fixation process. Furthermore, the formation of these species via reactions with B 4 and B 5 clusters is not adequately described under the assumption of thermodynamic equilibrium, as is demonstrated in our kinetic modelling. Thus, the accumulation of both B 4 N 4 and B 5 N 4 depends on the background gas pressure and the gas cooling rate. Long BN chains and rings, which are precursors of the fullborene and BNNT growth, form via self-assembly of components B 4 N 4 and B 5 N 4 . Our modelling results—particularly the increased densities of B 4 N 4 and B 5 N 4 species at higher gas pressures—explain the experimentally observed effect of gas pressure on the yield of high-quality BNNTs. The catalytic role of hydrogen was also studied; it is shown that HBNH molecules can be the main precursor of BNNT synthesis in the presence of hydrogen.

77 NANOSCIENCE AND NANOTECHNOLOGY↗
DOE OSTI2022

Low Cost, High Volume, Carbon Fiber Precursor for Plasma Oxidation

Light weighting with carbon fiber is critical to improving the energy efficiency of wind turbines, airplanes, and automobiles, but the high cost of carbon fiber continues to limit market growth and applications. Half of this cost is in the raw materials. For the carbon fiber market to reach the next level of adoption, the cost of both the raw materials and conversion must be reduced. This project considered the combination of low-cost, textile-grade precursors combined with the increased efficiency of plasma oxidation to greatly reduce the cost of carbon fiber. The primary objective of this project was to make industrial-grade carbon fiber (550 ksi tensile strength, 35 Msi tensile modulus) from textile-grade PAN precursors, something that cannot be achieved with conventional oxidation and to date has not been achieved with any technology. To accomplish this, the project team iteratively optimized the process conditions in the plasma oxidation and carbonization stages to maximize the tensile properties of the resultant carbon fibers. This involved implementing experimental designs for both stages, whereby process conditions (e.g. temperature) were varied and correlated to fiber properties. Samples of oxidized PAN fibers (OPFs) were prepared using a small pilot-scale plasma oxidation oven at 4XTechnologies (4XT). The thermal, chemical, and physical properties of OPF samples were analyzed by the University of Tennessee (UTK) and Oak Ridge National Laboratory (ORNL). The OPF samples were then converted to carbon fiber by subsequent low- and high-temperature carbonization using a lab-scale furnace at ORNL. The resultant carbon fibers were tested for tensile strength also at ORNL, and the results were fed back into the experimental design. Of the hundreds of carbon fiber samples produced over the course of the project, the best sample had an average break strength of 479 ksi and modulus of 33 Msi. While the best tensile properties achieved fell short of the final project targets of 550 ksi for break strength and 35 Msi for modulus, the team demonstrated the potential to produce industrial-grade carbon fiber using textile-grade precursors. The best performing fiber samples had tensile properties that are 87% of the goal for tensile strength and 94% of the goal for tensile modulus. With additional optimization work, it is likely that the targets could be achieved, since only a fraction of the process parameter space was explored during this project. 4XT and its affiliate (4M) have already secured funding through private equity, and there is a CRADA (Cooperative Research and Development Agreement) project currently underway with the Carbon Fiber Technology Center (CFTF) at ORNL to continue this research. Additionally, while not an original goal of the project, the carbon fibers for most samples had diameters >8.5μm. This is considerably larger than commercially available carbon fiber products, which can impart unique properties to the composites (e.g. increased compressive strength) and decrease manufacturing costs even further. Moreover, these fibers were oxidized with plasma oxidation using residence times ranging <60mins, which would be considered fast for normal diameter fibers, but it is as much as 5x faster when factoring in the diameter of the fibers.

36 MATERIALS SCIENCE↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Conti Ransomware Attack on the Health Service Executive of Ireland 2021

The Conti Ransomware Attack on the Health Service Executive (HSE) of Ireland 2021 Precursor Analysis Report leverages publicly available information about the attack and catalogs anomalous observables for each technique employed by the adversary. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The HSE provides public healthcare corporate services and operational services throughout Ireland, with critical functions including the acute national ambulance service, acute hospital service, and community healthcare service. On 14 May 2021, Conti ransomware encrypted 80 percent of the HSE’s Information Technology (IT) infrastructure across corporate, hospital, community, and electronic health record services. Conti is a ransomware-as-a-service operation that encrypts local files, uses double extortion against victims, and is facilitated by many intrusion tools. The attack forced the HSE to shut down its entire IT infrastructure to contain the ransomware, forcing employees to revert to pen and paper recordkeeping and leading to the cancellation of many appointments and procedures. The adversary also exfiltrated 700 GB of data, compromising the confidentiality of patients’ protected health information. Had the adversary targeted the COVID-19 cloud systems or operational technology assets, such as Internet of Medical Things medical devices or smart building management systems, the impact of the attack would almost certainly have been far more severe. Researchers and analysts identified 21 unique techniques (used in a sequence of 23 steps) likely utilized during the attack with a total of 1,185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-one of the identified techniques used during the attack on the HSE were precursors to the triggering event. Analysis identified 1,086 observables associated with these precursor techniques, 850 of which were assessed to have an increased likelihood of being perceived in the 57 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014

The Cyber Attack on Thyssenkrupp Blast Furnace 2014 Precursor Analysis Report leverages publicly available information about the Thyssenkrupp Steel Mill cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In December 2014, the German Government’s Federal Office for Information Security (BSI) released a report detailing a cyber attack on a German steel mill that occurred earlier that year, though exact dates and details of the attack were not revealed. While the report did not specify the name of the company, multiple sources identified the victim as one of Europe’s largest steel manufacturers, Thyssenkrupp AG. Further, Thyssenkrupp announced on 16 May of that year that Europe’s largest blast furnace, “Schwelgern 2,” located at its facility in Duisburg, Germany, would be offline for several weeks for repairs and upgrades, suggesting Schwelgern 2 was likely the target of the attack. The attack began in early 2014, when adversaries infiltrated the victim steel mill’s Information Technology (IT) network via a spearphishing campaign, then worked their way into the Operational Technology (OT) environment, where they executed software that caused denial of service, denial of control, and eventually a loss of control. This led to the blast furnace shutting down without proper safety procedures, resulting in catastrophic physical damage. No lives were lost in the incident, but ThyssenKrupp suffered $4 million in damage to the blast furnace and an additional $6 million in lost revenue. The adversaries required specialized knowledge and expertise in steel production, which enabled them to compromise a variety of internal systems and components across both IT and OT networks. The attack also demonstrated detailed knowledge of the industrial control systems (ICS) and production processes being used. This combination resulted in one of the earliest known publicly reported cybersecurity incidents resulting in physical damage to ICS equipment. Researchers and analysts identified 19 unique techniques (used in a sequence of 20 steps) utilized during the attack with a total of 454 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the Thyssenkrupp cyber attack were precursors to the triggering event. Analysis identified 369 observables associated with these precursor techniques, 316 of which were assessed to have an increased likelihood of being perceived in the 120 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Remote Access Attack on Oldsmar Water Treatment Facility 2021

The Remote Access Attack on Oldsmar Water Treatment Facility 2021 Precursor Analysis Report leverages publicly available information about the Oldsmar cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 5 February 2021, an adversary gained unauthorized remote access to Bruce T. Haddock Water Treatment Plant in Oldsmar, Florida, which provides treated water to 15,000 customers. The adversary accessed the facility’s Supervisory Control and Data Acquisition (SCADA) workstation and human machine interface (HMI) to change the chemical concentration of sodium hydroxide, commonly referred to as lye and used to regulate acidity levels, from 100 parts per million (PPM) to 11,100 PPM. The chemical was raised to lethal levels that if ingested could lead to serious soft tissue damage, burns, or even death. The facility, however, had redundancies and alarms in place to alert personnel of dangerous chemical levels, and facility officials stated it would have taken 24 to 36 hours for the chemical changes to affect the water supply. Researchers and analysts identified six unique techniques utilized during the attack with a total of 23 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Four of the identified techniques used during the Oldsmar cyber attack were precursors to the triggering event. Analysis identified 21 observables associated with these precursor techniques, 20 of which were assessed to have an increased likelihood of being perceived in the minutes preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRS2014

Increase of Ozone Concentrations, Its Temperature Sensitivity and the Precursor Factor in South China

Concerns have been raised about the possible connections between the local and regional photochemical problem and global warming. The current study assesses the trend of ozone in Hong Kong and the Pearl River Delta (PRD) in South China and investigates the interannual changes of sensitivity of ozone to air temperature, as well as the trends in regional precursors. Results reveal, at the three monitoring sites from the mid-1990s to 2010, an increase in the mean ozone concentrations from 1.0 to 1.6 microgram m(exp -3) per year. The increase occurred in all seasons, with the highest rate in autumn. This is consistent with trends and temperature anomalies in the region. The increase in the sensitivity of ozone to temperature is clearly evident from the correlation between ozone (OMI [Ozone Monitoring Instrument] column amount) and surface air temperature (from the Atmospheric Infrared Sounder) displayed in the correlation maps for the PRD during the prominently high ozone period of July September. It is observed to have increased from 2005 to 2010, the latter being the hottest year on record globally. To verify this temporal change in sensitivity, the ground-level trends of correlation coefficients/regression slopes are analysed. As expected, results reveal a statistically significant upward trend over a 14-year period (19972010). While the correlation revealed in the correlation maps is in agreement with the corresponding OMI ozone maps when juxtaposed, temperature sensitivity of surface ozone also shows an association with ozone concentration, with R0.5. These characteristics of ozone sensitivity are believed to have adverse implications for the region. As shown by ground measurements and/or satellite analyses, the decrease in nitrogen oxides (NO2) and NO(sub x) in Hong Kong is not statistically significant whileNO2 of thePRD has only very slightly changed. However, carbon dioxide has remarkably declined in the whole region. While these observations concerning precursors do not seem to adequately support an increasing ozone trend, measured surface levels of formaldehyde, a proxy for volatile organic compound (VOC) emissions, have risen significantly in the PRD (20042010). Hence, the reactive VOCs in the PRD are likely to be the main culprit for the increase of ozone, as far as precursors are concerned. Despite the prevailing problem, model simulations suggest prospects for improvement in the future.

South China↗
NASA NTRS2022

Changes in Anthropogenic Precursor Emissions Drive Shifts in the Ozone Seasonal Cycle Throughout the Northern Midlatitude Troposphere

Simulations by six Coupled Model Intercomparison Project Phase 6 (CMIP6) Earth system models indicate that the seasonal cycle of baseline tropospheric ozone at northern midlatitudes has been shifting since the mid-20th century. Beginning in ∼ 1940, the magnitude of the seasonal cycle increased by ∼10 ppb (measured from seasonal minimum to maximum), and the seasonal maximum shifted to later in the year by about 3 weeks. This shift maximized in the mid-1980s, followed by a reversal – the seasonal cycle decreased in amplitude and the maximum shifted back to earlier in the year. Similar changes are seen in measurements collected from the 1970s to the present. The timing of the seasonal cycle changes is generally concurrent with the rise and fall of anthropogenic emissions that followed industrialization and the subsequent implementation of air quality emission controls. A quantitative comparison of the temporal changes in the ozone seasonal cycle at sites in both Europe and North America with the temporal changes in ozone precursor emissions across the northern midlatitudes found a high degree of similarity between these two temporal patterns. We hypothesize that changing precursor emissions are responsible for the shift in the ozone seasonal cycle; this is supported by the absence of such seasonal shifts in southern midlatitudes where anthropogenic emissions are much smaller. We also suggest a mechanism by which changing emissions drive the changing seasonal cycle: increasing emissions of NOx allow summertime photochemical production of ozone to become more important than ozone transported from the stratosphere, and increasing volatile organic compounds (VOCs) lead to progressively greater photochemical ozone production in the summer months, thereby increasing the amplitude of the seasonal ozone cycle. Decreasing emissions of both precursor classes then reverse these changes. The quantitative parameter values that characterize the seasonal shifts provide useful benchmarks for evaluating model simulations, both against observations and between models.

Ozone↗
DOE OSTI2024

Synthesis of cerium precursors with alkoxide ligands for degradation to cerium oxide nanoparticles

Lanthanide oxide and sulfide nanoparticles present intriguing theoretical questions regarding their electronic structures, alongside numerous potential applications in material science and catalysis. Although these materials can be formed through hydrolysis, their synthesis via thermolysis is crucial for nanoscale materials and practical applications. This research aims to enhance our understanding of the decomposition mechanisms by focusing on cerium compounds, which are analogous to those studied previously. Currently, our knowledge of the decomposition mechanisms of cerium alkoxide precursors is limited. The objective of this project is to develop a mechanistic understanding of the formation of cerium oxide nanoparticles from cerium alkoxide precursors, employing a variety of techniques. These techniques include collision-induced dissociation in an ion-trap mass spectrometer, nuclear magnetic resonance (NMR) spectroscopy, thermogravimetric analysis coupled with differential scanning calorimetry (TGA-DSC), and gas chromatography-mass spectrometry (GC-MS) to investigate the decomposition mechanisms of the synthesized precursors.

37 - INORGANIC, ORGANIC, PHYSICAL AND ANALYTICAL C↗
DOE OSTI2018

Ultrasmall Zeolite L Crystals Prepared from Highly Interdispersed Alkali‐Silicate Precursors

Abstract The preparation of nanosized zeolites is critical for applications where mass‐transport limitations within microporous networks hinder their performance. Often the ability to generate ultrasmall zeolite crystals is dependent upon the use of expensive organics with limited commercial relevance. Herein, we report the generation of zeolite L crystals with uniform sizes less than 30 nm using a facile, organic‐free method. Time‐resolved analysis of precursor assembly and evolution during nonclassical crystallization highlights key differences among silicon sources. Our findings reveal that a homogenous dispersion of potassium ions throughout silicate precursors leads to the formation of a metastable nonporous phase, which undergoes an intercrystalline transformation to zeolite L. The generation of highly interdispersed alkali‐silicate precursors is seemingly critical to enhancing the rate of nucleation and facilitating the formation of ultrasmall crystal.

Li, Rui↗
DOE OSTI2020

Highly Ordered Carbon Coating Prepared with Polyvinylidene Chloride Precursor for High‐Performance Silicon Anodes in Lithium‐Ion Batteries

Abstract A highly ordered carbon structure based on polyvinylidene chloride precursor has been developed to host silicon nanoparticles. The stoichiometric ratio of sacrificial H and Cl elements facilitated full utilization of the carbon content of the precursor that produced robust carbon coatings on silicon nanoparticles with excellent mechanic properties and electrochemical stabilities. The optimal sintering temperature and carbon content have been investigated. When evaluated as the anode of a lithium‐ion battery (LIB), the Si : C 1 : 2 composite sintered at 800 °C (SiC12‐800) provided excellent capacity retention of 85 % at 0.1 C after 50 cycles with an enhanced CE, which reached 99 % only after 10 cycles. The SiC12‐800 electrode maintained a specific capacity of 709.2 mAh/g after 300 cycles at 0.3 C, and delivered a high rate performance of 737.9 mAh/g and 485.6 mAh/g at 5 C and 10 C, respectively. The results indicate that polymer precursors with stoichiometric ratio of sacrificial elements have high potential for generating highly robust carbon coatings for silicon anodes in high energy density LIBs.

Zhou, Shuo↗
DOE OSTI2018

Implementation of Precursor and Neutral Loss Scans on a Miniature Ion Trap Mass Spectrometer and Performance Comparison to a Benchtop Linear Ion Trap

Implementation of orthogonal double resonance precursor and neutral loss scans on the Mini 12 miniature rectilinear ion trap mass spectrometer is described, and performance is compared to that of a commercial Thermo linear trap quadropole (LTQ) linear ion trap. The ac frequency scan version of the technique at constant rf voltage is used here because it is operationally much simpler to implement. Remarkably, the Mini 12 shows up to two orders of magnitude higher sensitivity compared to that of the LTQ. Resolution on the LTQ is better than unit at scan speeds of ~ 400 Th/s, whereas peak widths on the Mini 12, on average, range from 0.5 to 2.0 Th full width at half maximum and depend heavily on the precursor ion Mathieu q parameter as well as the pump down time that precedes the mass scan. Both sensitivity and resolution are maximized under higher pressure conditions (short pump down time) on the Mini 12. The effective mass range of the product ion ejection waveform was found to be 5.8 Th on the Mini 12 in the precursor ion scan mode vs. that of 3.9 Th on the LTQ. In the neutral loss scan mode, the product ion selectivity was between 8 and 11 Th on the Mini 12 and between 7 and 8 Th on the LTQ. The effects of nonlinear resonance lines on the Mini 12 were also explored. .

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗