Search NASA⌕ Search

SEARCH · Search NASA

Results for “association analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 217 records · Page 12
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Omics-Lethal Human Viruses, MERS-CoV Experiment MMVE001

The purpose of this experiment was to evaluate the human host response to wild-type Middle Eastern Respiratory Syndrome coronavirus (icMERS-CoV) virus infection. Sample data was obtained from human microvascular endothelial cells for mRNA, miRNA, proteomics, lipidomics, and metabolomics expression analysis. Secondary host-associated viral dataset downloads contain one or more statistically processed (normalization data transformation) quantitative dataset collections resulting in qualitative expression analyses of primary host-pathogen experimental study designs. Leveraging unique high-resolution Omics capabilities for proteomics, metabolomics, lipidomics, and transcriptomics dataset downloads each have a direct relationship to a primary sample submission corresponding to a specific MERS-CoV virus infection.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2021

Omics-Lethal Human Viruses, MERS-CoV Experiment MMVE002

The purpose of this experiment was to evaluate the human host response to wild-type Middle Eastern Respiratory Syndrome coronavirus (icMERS-CoV EMC2012) virus infection. Sample data was obtained from primary human fibroblast cells for mRNA, proteomics, lipidomics, and metabolomics expression analysis. Secondary host-associated viral dataset downloads contain one or more statistically processed (normalization data transformation) quantitative dataset collections resulting in qualitative expression analyses of primary host-pathogen experimental study designs. Leveraging unique high-resolution Omics capabilities for proteomics, metabolomics, lipidomics, and transcriptomics dataset downloads each have a direct relationship to a primary sample submission corresponding to a specific MERS-CoV virus infection.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2021

Omics-Lethal Human Viruses, MERS-CoV Experiment MMVE003

The purpose of this experiment was to evaluate the human host response to wild-type Middle Eastern Respiratory Syndrome coronavirus (icMERS-CoV EMC2012) virus infection. Sample data was obtained from human microvascular endothelial cells for mRNA, proteomics, lipidomics, and metabolomics expression analysis. Secondary host-associated viral dataset downloads contain one or more statistically processed (normalization data transformation) quantitative dataset collections resulting in qualitative expression analyses of primary host-pathogen experimental study designs. Leveraging unique high-resolution Omics capabilities for proteomics, metabolomics, lipidomics, and transcriptomics dataset downloads each have a direct relationship to a primary sample submission corresponding to a specific MERS-CoV virus infection.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2021

Plutonium Redox Transformation in the Presence of Iron, Organic Matter, and Hydroxyl Radicals: Kinetics and Mechanistic Insights

Plutonium (Pu) redox and complexation processes in the presence of natural organic matter and associated iron can impact the fate and transport of Pu in the environment. In this work, we studied the fate of Pu(IV) in the presence of humic acid (HA) and Fe(II) upon reaction with H 2 O 2 that may be generated by photochemical and other reactions. A portion of Pu(IV) was oxidized to Pu(V/VI), which is primarily ascribed to the generation of reactive intermediates from the oxidation of Fe(II) and Fe(II)–HA complexes by H 2 O 2 . The kinetics of Pu(IV) oxidation is pH-dependent and can be described by a model that incorporates Pu redox kinetics with published HA-modified Fenton reaction kinetics. At pH 3.5, the presence of HA slowed Pu(IV) oxidation, while at pH 6, HA accelerated Pu(IV) oxidation in the first several hours followed by a reverse process where the oxidized Pu(V/VI) was reduced back to Pu(IV). Analysis of Pu-associated particle size suggests that Pu oxidation state is a major driver in its complexation with HA and formation of colloids and heteroaggregates. Our results revealed the H 2 O 2 -driven oxidation of Pu(IV)–HA–Fe(II) colloids with implications to the transient mobilization of Pu(V/VI) in organic-rich redox transition zones.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2024

Understanding Formation of Irradiation-Induced Defects through 4D-STEM, Electron Tomography, and WBDF-STEM

A major challenge in advancing nuclear materials for next-generation fission and proposed fusion reactors is to comprehensively understand the formation of irradiation-induced defects. Here it is essential to correlate the evolution of irradiation-induced defects and the degradation of mechanical properties, as they collectively dictate the material's lifespan and ensure nuclear safety. Scanning transmission electron microscopy (STEM) based techniques have emerged as indispensable tools for irradiation-induced defect characterization, offering high spatial resolution imaging and chemical analysis, such as electron energy loss spectroscopy (EELS) and energy dispersive X-ray spectroscopy (EDXS). These techniques have been effectively used to obtain an atomic-scale view of the defect structure. Recent advances in electron microscopy, particularly in 4D-STEM, offer detailed insight into microstructural evolution by capturing full 2D diffraction patterns at every pixel position. Using high-speed direct electron detectors, this technology generates a four-dimensional dataset, overcoming the limitations of traditional STEM imaging.

36 MATERIALS SCIENCE↗
DOE OSTI2022

Image analysis reveals differences in tumor multinucleations in Black and White patients with human papillomavirus‐associated oropharyngeal squamous cell carcinoma

Background Understanding biological differences between different racial groups of human papillomavirus (HPV)‐associated oropharyngeal squamous cell carcinoma (OPSCC) patients, who have differences in terms of incidence, survival, and tumor morphology, can facilitate accurate prognostic biomarkers, which can help develop personalized treatment strategies. Methods This study evaluated whether there were morphologic differences between HPV‐associated tumors from Black and White patients in terms of multinucleation index (MuNI), an image analysis‐derived metric that measures density of multinucleated tumor cells within epithelial regions on hematoxylin–eosin images and previously has been prognostic in HPV‐associated OPSCC patients. In this study, the authors specifically evaluated whether the same MuNI cutoff that was prognostic of overall survival (OS) and disease‐free survival in their previous study, T TR , is valid for Black and White patients, separately. We also evaluated population‐specific cutoffs, T B for Blacks and T W for Whites, for risk stratification. Results MuNI was statistically significantly different between Black (mean, 3.88e–4; median, 3.67e–04) and White patients (mean, 3.36e–04; median, 2.99e–04), with p = .0078. Using T TR , MuNI was prognostic of OS in the entire population with hazard ratio (HR) of 1.71 ( p = .002; 95% confidence interval [CI], 1.21–2.43) and in White patients with HR of 1.72 ( p = .005; 95% CI, 1.18–2.51). Population‐specific cutoff, T W , yielded improved HR of 1.77 ( p = .003; 95% CI, 1.21–2.58) for White patients, whereas T B did not improve risk‐stratification in Black patients with HR of 0.6 ( p = .3; HR, 0.6; 95% CI, 0.2–1.80). Conclusions Histological difference between White and Black patient tumors in terms of multinucleated tumor cells suggests the need for considering population‐specific prognostic biomarkers for personalized risk stratification strategies for HPV‐associated OPSCC patients.

Koyuncu, Can F.↗
DOE OSTI2025

Barriers and Benefits: Understanding Riders’ Views on Pooled Rideshare in the U.S.

This manuscript provides actionable recommendations to enhance user satisfaction and address existing barriers regarding pooled rideshare (PR) in the United States. Despite PR’s intended benefits, such as reduced traffic congestion and cost savings, its adoption remains limited. To identify these actionable items, a U.S. nationwide survey with 5385 participants explored transportation preferences, barriers, and motivators for PR use in the summer of 2021. First, two factor analyses were conducted. The first factor analysis identified the five factors associated with one’s willingness to consider PR (time/cost, traffic/environment, safety, privacy, and service experience). The second factor analysis revealed the four factors related to ways to optimize one’s PR experience (comfort/ease of use, convenience, vehicle technology/accessibility, and passenger safety). Privacy concerns, for instance, were found to reduce the likelihood of PR adoption by 77%, and convenience had the potential to increase it by 156%. A structural equation model evaluated the relationships among these nine key factors influencing PR usage to develop the Pooled Rideshare Acceptance Model (PRAM). The privacy, safety, trust service, and convenience factors each had a significant large effect (Cohen’s f 2 > 0.35) on the model. PRAM was extended using multigroup analyses to reveal the nuanced impact of 16 demographics, including gender, generation, rideshare experience, etc., highlighting the need for tailored strategies to improve PR acceptance through the Pooled Rideshare Acceptance Model Multigroup Analyses (PRAMMAs). Multiple workshops were held with diverse audiences to translate the team’s findings to date into 84 actionable recommendations, categorized across topical areas like safety, routing, driver and passenger selection, user education, etc. These findings are a foundation for a future study to determine which items resonate with different user groups. In the meantime, the actional items serve as a user-driven resource for policymakers, transportation network companies, and researchers, offering a roadmap to potential improvements to PR services to address existing concerns with the goal of increasing the usage of PR.

actionable recommendations↗
DOE OSTI2023

Precursor Analysis Report: Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022

The Industroyer2 and Wiper Malware Targeting Ukrainian Energy Provider 2022 Precursor Analysis Report leverages publicly available information about the Industroyer2 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. An adversary attempted to cause a blackout in Ukraine in April 2022 by using the Industroyer2 malware against a regional Ukrainian energy provider. The adversary targeted eight high-voltage electrical substations and utilized the malware in tandem with disk wipers for Windows, Linux, and Solaris operating systems in an attempt to make response and recovery efforts more difficult. The adversary reused a piece of the original Industroyer malware designed to open circuit breakers and de-energize target substations. The adversary gained initial access to the victim’s enterprise network through unknown means in February 2022 and was able to perform reconnaissance, pivot to the operations network, and reside in the system for at least 51 days. This gave the adversary a detailed understanding of the environment and allowed them to customize the Industroyer2 malware to the victim’s operations network. However, defenders detected and stopped the attack before the adversary could achieve their intended impact. Had the Industroyer2 attack been successful, it could have caused a blackout for more than two million people during the early stages of Russia’s invasion of Ukraine. Researchers and analysts identified 22 unique techniques (used in a sequence of 31 steps) utilized during the attack with a total of 297 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-three of the identified techniques used during the Industroyer2 cyber attack were precursors to the triggering event. Analysis identified 224 observables associated with these precursor techniques, 122 of which were assessed to have an increased likelihood of being perceived in the 51 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016

The Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Precursor Analysis Report leverages publicly available information about the December 2016 cyber attack against the Ukrainian Ukrenergo electric transmission utility and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. Industroyer is a modular malware framework designed to deploy several Industrial Control System (ICS) protocol-specific attack payloads to disrupt electricity distribution. Adversaries deployed Industroyer within the target network on a Microsoft Windows endpoint capable of directly manipulating or communicating with ICS. Industroyer abuses the functionality of a targeted ICS’s legitimate control system to achieve its intended impact. Adversaries likely first gained access to Ukrenergo enterprise networks in early 2016 after a successful spearphishing campaign against organizations in the electric power sector. Adversaries then began capturing credentials beginning on 1 December 2016. This allowed access to the ICS environment at the Pivnichna electric transmission substation outside Kyiv through a device dual-homed on the Information Technology (IT) and ICS networks. Adversaries conducted discovery, targeting, and access to this device using information and previously captured credentials from compromised enterprise IT machines. Finally, the adversaries deployed and launched the Industroyer malware just before midnight on 17 December. By midnight, Ukrenergo had lost control of a targeted substation, resulting in electric power outages for over an hour in the city of Kyiv and the Kyiv region. Researchers and analysts identified 31 unique techniques (used in a sequence of 33 steps) utilized during the attack with a total of 846 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Twenty-nine of the identified techniques used during the Industroyer cyber attack were precursors to the triggering event. Analysis identified 548 observables associated with these precursor techniques, 353 of which were assessed to have an increased likelihood of being perceived in the 300 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: JBS Foods Ransomware Attack 2021

The JBS Foods 2021 Ransomware Attack Precursor Analysis Report leverages publicly available information about the JBS ransomware cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In late May 2021, one of the world’s largest meat producers, JBS Foods, announced they had fallen victim to a worldwide ransomware attack, later found to be REvil ransomware. In the United States alone, JBS Foods accounts for nearly 25% of beef and roughly 20% of pork production. Adversaries initially launched a Distributed Denial of Service (DDoS) attack on the company’s Information Technology (IT) networks in Australia, but the attack impacted operations in Brazil, Canada, and the United States, as well. The attack caused plant operations in all four countries to shut down for at least one day. All nine of the U.S. meatpacking plants temporarily shut down because of the attack. The adversaries initially demanded a $\$$22 million ransom for the company’s data, but later negotiated the ransom down to $\$$11 million even after JBS Foods restored most of their systems. JBS Foods eventually paid the $\$$11 Million for reassurance from the adversaries that none of their customers’ data would be compromised in the future. Despite its short duration, the attack still caused large stocks of meat to spoil. The incident also underscored how adversaries can simultaneously compromise and move laterally through global subsidiaries of an organization. Researchers and analysts identified 22 unique techniques (in a sequence of 21 steps) utilized during the attack with a total of 361 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Sixteen of the identified techniques used during the JBS Foods cyber attack were precursors to the triggering event. Analysis identified 308 observables associated with these precursor techniques, 163 of which were assessed to have an increased likelihood of being perceived in the 75 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: Ryuk Ransomware Attack on Universal Health Services 2020

The Ryuk Ransomware Attack on Universal Health Services (UHS) 2020 Precursor Analysis Report leverages publicly available information about the 2020 UHS cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. UHS manages over 400 hospitals and is one of the largest healthcare providers in the United States with 3.5 million patients each year. On 27 September 2020, UHS suffered a widespread ransomware attack that resulted in a denial of service to critical internet-dependent healthcare systems including workstations, phones, and data centers. Employees resorted to filing patient details with pen and paper, while other facilities had to redirect ambulances and urgent patients to other facilities for adequate care. Adversaries carried out the attack with Ryuk, a ransomware that encrypts data and generates a RyukReadMe.txt ransom note with the ransom fee to decrypt the data, varying from 15 Bitcoin (BTC) to 50 BTC, equivalent to roughly $\$$353,892 to $\$$964,617. UHS did not pay the ransom and was able to recover data through backups, but still reported an impact of $\$$67 million dollars in recovery costs. On 29 October, one month after the attack, UHS made an official statement that their systems had been restored and they were resuming normal operations. Researchers and analysts identified 18 unique techniques (used in a sequence of 19 steps) utilized during the attack with a total of 185 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fourteen of the identified techniques used during the UHS cyber attack were precursors to the triggering event. Analysis identified 106 observables associated with these precursor techniques, 82 of which were assessed to have an increased likelihood of being perceived in the 30 days to two hours preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Precursor Analysis Report: SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003

The SQL Slammer Worm Infection of Davis-Besse Nuclear Power Plant 2003 Precursor Analysis Report leverages publicly available information about Davis-Besse’s 2003 cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 25 January 2003, the SQL Slammer worm infected more than 90% of vulnerable hosts and crashed the internet in 10 to 15 minutes, making it one of the fastest spreading worms in history. SQL Slammer is a fileless, memory-resident worm that remotely exploits a stack-based buffer overflow vulnerability on local hosts to intensively scan and rapidly self-propagate across the internet. The worm infected approximately 300,000 unpatched hosts running Microsoft Structured Query Language (SQL) Server 2000 or Microsoft Desktop Engine (MSDE) 2000 with SQL Server Resolution Service. The SQL Slammer worm indirectly infected FirstEnergy’s Davis-Besse nuclear power plant by first infecting a consultant’s company network server and then propagating through an external misconfigured connection into Davis-Besse’s site network. The infection caused major network congestion, slow performance, data overloads, and the inability of local hosts to communicate with each other, which eventually caused a loss of availability and a loss of view when the Safety Parameter Display System (SPDS) and Plant Process Computer (PPC) crashed. At the time of the infection, the plant was already offline, the digital monitoring systems had redundant analog backups, and the plant control and safety functions were not affected, so there were no concerns of a safety breach. However, this incident resulted in many lessons learned and spawned important discussions about cybersecurity’s role in nuclear safety and electric power reliability regulation, policy, and guidance. Researchers and analysts identified 10 unique techniques utilized during the attack with a total of 640 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Eight of the identified techniques used during Davis-Besse cyber attack were precursors to the triggering event. Analysis identified 596 observables associated with these precursor techniques, 428 of which were assessed to have an increased likelihood of being perceived in the 331 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Cyber Attack on Thyssenkrupp Blast Furnace 2014

The Cyber Attack on Thyssenkrupp Blast Furnace 2014 Precursor Analysis Report leverages publicly available information about the Thyssenkrupp Steel Mill cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. In December 2014, the German Government’s Federal Office for Information Security (BSI) released a report detailing a cyber attack on a German steel mill that occurred earlier that year, though exact dates and details of the attack were not revealed. While the report did not specify the name of the company, multiple sources identified the victim as one of Europe’s largest steel manufacturers, Thyssenkrupp AG. Further, Thyssenkrupp announced on 16 May of that year that Europe’s largest blast furnace, “Schwelgern 2,” located at its facility in Duisburg, Germany, would be offline for several weeks for repairs and upgrades, suggesting Schwelgern 2 was likely the target of the attack. The attack began in early 2014, when adversaries infiltrated the victim steel mill’s Information Technology (IT) network via a spearphishing campaign, then worked their way into the Operational Technology (OT) environment, where they executed software that caused denial of service, denial of control, and eventually a loss of control. This led to the blast furnace shutting down without proper safety procedures, resulting in catastrophic physical damage. No lives were lost in the incident, but ThyssenKrupp suffered $4 million in damage to the blast furnace and an additional $6 million in lost revenue. The adversaries required specialized knowledge and expertise in steel production, which enabled them to compromise a variety of internal systems and components across both IT and OT networks. The attack also demonstrated detailed knowledge of the industrial control systems (ICS) and production processes being used. This combination resulted in one of the earliest known publicly reported cybersecurity incidents resulting in physical damage to ICS equipment. Researchers and analysts identified 19 unique techniques (used in a sequence of 20 steps) utilized during the attack with a total of 454 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the Thyssenkrupp cyber attack were precursors to the triggering event. Analysis identified 369 observables associated with these precursor techniques, 316 of which were assessed to have an increased likelihood of being perceived in the 120 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Remote Access Attack on Oldsmar Water Treatment Facility 2021

The Remote Access Attack on Oldsmar Water Treatment Facility 2021 Precursor Analysis Report leverages publicly available information about the Oldsmar cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 5 February 2021, an adversary gained unauthorized remote access to Bruce T. Haddock Water Treatment Plant in Oldsmar, Florida, which provides treated water to 15,000 customers. The adversary accessed the facility’s Supervisory Control and Data Acquisition (SCADA) workstation and human machine interface (HMI) to change the chemical concentration of sodium hydroxide, commonly referred to as lye and used to regulate acidity levels, from 100 parts per million (PPM) to 11,100 PPM. The chemical was raised to lethal levels that if ingested could lead to serious soft tissue damage, burns, or even death. The facility, however, had redundancies and alarms in place to alert personnel of dangerous chemical levels, and facility officials stated it would have taken 24 to 36 hours for the chemical changes to affect the water supply. Researchers and analysts identified six unique techniques utilized during the attack with a total of 23 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Four of the identified techniques used during the Oldsmar cyber attack were precursors to the triggering event. Analysis identified 21 observables associated with these precursor techniques, 20 of which were assessed to have an increased likelihood of being perceived in the minutes preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2023

Genome-wide association study identifies four pan-ancestry loci for suicidal ideation in the Million Veteran Program

Suicidal ideation (SI) often precedes and predicts suicide attempt and death, is the most common suicidal phenotype and is over-represented in veterans. The genetic architecture of SI in the absence of suicide attempt (SA) is unknown, yet believed to have distinct and overlapping risk with other suicidal behaviors. We performed the first GWAS of SI without SA in the Million Veteran Program (MVP), identifying 99,814 SI cases from electronic health records without a history of SA or suicide death (SD) and 512,567 controls without SI, SA or SD. GWAS was performed separately in the four largest ancestry groups, controlling for sex, age and genetic substructure. Ancestry-specific results were combined via meta-analysis to identify pan-ancestry loci. Four genome-wide significant (GWS) loci were identified in the pan-ancestry meta-analysis with loci on chromosomes 6 and 9 associated with suicide attempt in an independent sample. Pan-ancestry gene-based analysis identified GWS associations with DRD2, DCC, FBXL19, BCL7C, CTF1, ANNK1, and EXD3. Gene-set analysis implicated synaptic and startle response pathways (q’s<0.05). European ancestry (EA) analysis identified GWS loci on chromosomes 6 and 9, as well as GWS gene associations in EXD3, DRD2, and DCC. No other ancestry-specific GWS results were identified, underscoring the need to increase representation of diverse individuals. The genetic correlation of SI and SA within MVP was high (r G = 0.87; p = 1.09e-50), as well as with post-traumatic stress disorder (PTSD; r G = 0.78; p = 1.98e-95) and major depressive disorder (MDD; r G = 0.78; p = 8.33e-83). Conditional analysis on PTSD and MDD attenuated most pan-ancestry and EA GWS signals for SI without SA to nominal significance, with the exception of EXD3 which remained GWS. Our novel findings support a polygenic and complex architecture for SI without SA which is largely shared with SA and overlaps with psychiatric conditions frequently comorbid with suicidal behaviors.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2026

Data from: Lowland Tropical Forests Remain a Methane Sink Under Warming and Long-Term Hurricane Disturbance Recovery

The repository folder contains spreadsheets and script for soil greenhouse gas (GHG) fluxes, soil moisture, soil temperature, air temperature, and precipitation measurements collected from the Tropical Responses to Altered Climate Experiment (TRACE) at the Sabana Research Field Station, El Yunque National Forest (USDA Forest Service; 18°19′28.74″ N, 65°43′50.09″ W) — an open-air field warming experiment located in a lowland tropical forest in Puerto Rico within the Luquillo Experimental Forest (LEF) — six to seven years after Hurricanes Irma and Maria (2017). All spreadsheets for soil and air microclimate data, as well as soil greenhouse gas data, are included as csv files. Air temperature data are also included as Excel spreadsheets (.xlsx). The script is built in R Studio, which is the only software required to run data analysis. This dataset is associated with the manuscript “Larocca Conte G ; Zuvela L ; Cruz-Pérez R ; Barreto-Vélez T ; Becerra-Santillan N ; Campbell S ; Chu H ; Dam T ; Grullón-Penkova I ; Kleit M ; Ortiz-Iglesias D ; Rubio-Lebrón L ; Cavaleri M ; Reed S ; Sihi D ; Wood T ; O'Connell C., 2026. Lowland Tropical Forests Remain a Methane Sink Under Warming and Long-Term Hurricane Disturbance Recovery. Agricultural and Forest Meteorology. In review". The dataset was used to test the effect of warming on soil CH4 dynamics following long-term legacy effects of hurricane disturbance. The dataset includes: - An overall README file in word and pdf format describing methodology and spreadsheets’ structure. - Continuous measurements of soil temperature and moisture from January 2023 to July 2024 measured with Campbell CS655 probes (“TRACE_soil_temperature_and_moisture_2023_cleaned(in).csv” and “TRACE_soil_temperature_and_moisture_2024_cleaned. csv”). - Air temperature data measured with a HOBO MX23O1A data logger (“Hobo air temperature 2023 Sep 2024” and “Hobo air temperature 2023 Sep 2024” – “CSV FILES folders”). - Precipitation data from a nearby weather tower downloaded from González et al. (2025; “sabana_2020-2025.csv”). - Soil CH4 and CO2 effluxes measured intermittently in two summer campaigns (June – August 2023 and June – July 2024) with a LI-COR 8200-01S Portable Smart Chamber coupled with a LI-COR LI-7810 CH4/ CO2/H2O Trace Gas Analyzer (“23_24COMBO2.0.csv”). - R markdown script for data analysis (“Trace new_PLOTS.Rmd”).

54 ENVIRONMENTAL SCIENCES↗