Search NASA⌕ Search

SEARCH · Search NASA

Results for “Event analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2025

Climate change and federal aid disbursements after Hurricane Harvey: an extreme event attribution analysis

The role climate change plays in increasing the burden placed on governments and insurers to pay for recovery has not been extensively explored and is the focus of this study. This study examines the impacts of climate change attributed flooding on federal disaster aid disbursement in Harris County, Texas following Hurricane Harvey in 2017. Our approach uses flood models to estimate the amount of flood damages attributable and not attributable to climate change under two climate change attribution scenarios from peer reviewed studies: 20% and 38% increases in rainfall associated with the hurricane due to climate change. These estimates are combined with census tract-level disbursement data for FEMA’s National Flood Insurance Program (NFIP) and the Individual Assistance (IA) part of the Individuals and Households Program. We employ spatial lag regression models with direct and spatial spillover effects to analyze the relationship between a tract’s flood damages—both attributed and not attributed to climate change—and federal disaster aid. We find that both types of flood damage shape federal aid disbursements, but that climate change attributed damages tend to have larger effect sizes (elasticities) especially for IA. Specifically, for a 1% increase in additional climate change attributed damages per household in a census tract (under the 20% scenario), expected NFIP levels in that census tract are 0.26% higher and IA levels are 0.3% higher. Implications center on federal funding in an era of climate change.

FEMA↗
DOE OSTI2023

High event rate analysis technique for the dual-axis duo-lateral position-sensitive silicon detectors of FAUST

The dual-axis duo-lateral (DADL) position-sensitive silicon detector was developed to obtain precise position and energy information for detected charged particles. The Forward Array Using Silicon Technology (FAUST) is currently equipped with 68 DADL detectors backed by CsI(Tl) scintillators for the study of charged particle correlations in heavy-ion collisions where precise position and energy information is essential. When conventional signal processing electronics were used for the DADL detectors, a position dependence of the measured energy as well as distortions in the calculated particle positions were observed. In previous work, waveforms from the detector after preamplification were studied to better understand the features that give rise to these distortions; therein, a waveform analysis technique was developed to improve the energy resolution and linearity in position reconstruction. However, the reading and writing of waveforms for an entire detector array limits data collection rates and adds significant burden in data storage and analysis speed. In this work, the integrators of a Struck SIS3316 ADC were utilized to process 228 Th source data to develop and optimize a new analysis method that captures the benefits of the waveform analysis technique while circumventing the waveform writing requirement. This integrator method – capable of 59 keV (FWHM) energy resolution – was used in the collection of 35 MeV/nucleon 28 Si + 12 C collision data using FAUST to investigate exotic decays of highly excited highly deformed nuclei. In this data, a position resolution of 0.4 mm (FWHM) was obtained for 25 MeV α-particles; for α-particles near this energy that originate from 8 Be ground state decays, a 8 Be ground state width of 30 keV (FWHM) was obtained. The impact of the energy-dependent DADL position resolution emergent from electronic noise on the quality of excited state measurement was modeled and compared to the experimental data.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2020

Measurement Uncertainty in One-Of-A-Kind Event Data Analysis

A golden standard in science is to repeat an experiment a statistically significant number of times, recording data using the same set of detectors and the same data analysis methodology. In such case experimental error includes both the range of true values generated by repetitions of the experiment, and measurement uncertainty caused by the detector. They are independent. It is a huge and too frequently used simplification, to assume that one can measure multiple repetitions of an identical experiment, resulting in identical true experimental value. Repetitions, as similar is it is experimentally achievable, have unavoidable built-in differences resulting in a range of the true values rather than in a single value. When modern, very sensitive and well calibrated measurement systems are used, this range is not negligible, and sometimes dominates over the measurement uncertainty. Range of true values depends on built-in differences in physics of the experiment. Stochastic physical processes result typically in a broader range of true values than non-stochastic processes do. Measurement uncertainty depends on a measurement method (properties of the detector not of the experiment). Modern measurement methods, including digital ones, frequently make the measurement uncertainty very small. When data from one–of –a kind experiment are analyzed, only the measurement uncertainty is reported. It provides no information about the range of true experimental values, neither about reliability of a reported data point. Reliability of a data point is in general independent from its measurement uncertainty. However, in practice reliable measurement methods frequently have high measurement uncertainty, while low reliability methods are applied to limit measurement uncertainty. Comparison of reliable data with high measurement uncertainty to not so reliable data measured with low uncertainty is discussed – in different scenarios different data analysis methods are applicable. Methods for data analysis from an experiment repeated statistically significant number of times are very well developed. They do not require a detailed expertise in physics of an experiment, nor in the properties of the measurement system used, and meaning of the reported uncertainty is well understood in any scientific community. It all changes when data from one-of-a-kind experiment is analyzed. Analyst’s expertise is required both in the physics of the experiment and in all aspects of the measurement system, all possible malfunctions. Data users must remember that only measurement uncertainty is reported from any one-of-a-kind experiment. Theory with simulations may provide estimation of expected built-in differences in the experiment, and by this of expected range of true values for a given experiment; yet measurement uncertainty can never be used in place of the range of true experimental values.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2024

Search for non-resonant Higgs boson pair production in the $2b+2\ell +{E}_{\textrm{T}}^{\textrm{miss}}$ final state in pp collisions at $\sqrt{s}$ = 13 TeV with the ATLAS detector

A search for non-resonant Higgs boson pair (HH) production is presented, in which one of the Higgs bosons decays to a b-quark pair ($b\bar{b}$) and the other decays to WW * , ZZ * , or τ + τ – , with in each case a final state with ℓ + ℓ – + neutrinos (ℓ = e, μ). The analysis targets separately the gluon-gluon fusion and vector boson fusion production modes. Data recorded by the ATLAS detector in proton-proton collisions at a centre-of-mass energy of 13 TeV at the Large Hadron Collider, corresponding to an integrated luminosity of 140 fb –1 , are used in this analysis. Events are selected to have exactly two b-tagged jets and two leptons with opposite electric charge and missing transverse momentum in the final state. These events are classified using multivariate analysis algorithms to separate the HH events from other Standard Model processes. No evidence of the signal is found. The observed (expected) upper limit on the cross-section for non-resonant Higgs boson pair production is determined to be 9.7 (16.2) times the Standard Model prediction at 95% confidence level. The Higgs boson self-interaction coupling parameter κ λ and the quadrilinear coupling parameter κ 2V are each separately constrained by this analysis to be within the ranges [–6.2, 13.3] and [–0.17, 2.4], respectively, at 95% confidence level, when all other parameters are fixed.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗
DOE OSTI2024

Simulator Data Analysis to Inform Digitalized Environment Impacts on Human Reliability

The U.S. Nuclear Regulatory Commission (NRC) has developed a human reliability analysis (HRA) method, termed the Integrated Human Event Analysis System for Event and Condition Assessment (IDHEAS-ECA), in order to estimate human error probabilities (HEPs) in risk-informed regulatory applications. To update the quantification part of IDHEAS-ECA, the NRC required human performance and error data from fully digitalized main control rooms (MCRs); therefore, it requested that Idaho National Laboratory (INL) revisit previous data collection studies and investigate how the following three factors impact human reliability: self-checking, peer-checking, and automation. The HRA data collection studies revisited were the Human Reliability Data Extraction (HuREX) project, developed by the Korea Atomic Energy Research Institute (KAERI), and the Simplified Human Error Experimental Program (SHEEP), developed by INL. HuREX is a representative HRA data collection study that collects human reliability data from full-scope simulators staffed by licensed operators. SHEEP, on the other hand, has been proposed to complement such full-scope studies by collecting data via simplified simulators staffed by non-licensed student operators. In the HuREX study, KAERI collected HRA data from fully digitalized MCRs for the Advanced Power Reactor (APR)–1400. The SHEEP data were obtained from simplified simulators that partially mimicked the features of digitalized MCRs. The present report mainly discusses how the impacts of the aforementioned three factors on human errors were derived from these two data collection studies.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2024

Applying Automated Detectors for Regional Infrasound Signals to Global Networks: A Case Study Using the 2022 Hunga Tonga Volcanic Eruption

The January 15, 2022 Tonga Hunga volcanic eruption was the largest event to be recorded across the International Monitoring System infrasound network. Signals from the eruption were identified at all 53 operational stations by International Data Centre analysts. This report contains descriptors for signal detection bulletins produced by infrasound researchers at Sandia National Laboratories and Los Alamos National Laboratory. Manual detection bulletins were produced by laboratory staff. Automated detection bulletins were produced using automated infrasound processing tools developed at both laboratories. Initial results are provided to evaluate the utility of extending tools developed for regional infrasound event analysis to global-scale events.

58 GEOSCIENCES↗
DOE OSTI2023

A stochastic model of future extreme temperature events for infrastructure analysis

Applying extreme temperature events for future conditions is not straightforward for infrastructure resilience analyses. This work introduces a stochastic model that fills this gap. The model uses at least 50 years of daily extreme temperature records, climate normals with 10%-90% confidence intervals, and shifts/offsets for increased frequency and intensity of heat wave events. Intensity and frequency are shifted based on surface temperature anomaly from 1850-1900 for 32 models from CMIP6. A case study for Worcester, Massachusetts passed 85% of cases using the two-sided Kolmogorov-Smirnov -value test with 95% confidence for both temperature and duration. Future shifts for several climate scenarios to 2020, 2040, 2060, and 2080 had acceptable errors between the shifted model and 10- and 50-year extreme temperature event thresholds with the largest error being 2.67 degrees C. The model is likely to be flexible enough for other patterns of extreme weather such as extreme precipitation and hurricanes.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2023

Applying AI/ML Techniques to U.S. Nuclear Operating Experience Program

Idaho National Laboratory (INL) has provided technical assistance to the U.S. Nuclear Regulatory Commission (NRC) in reliability and risk analysis including the operating experience (OpE) program since the 1980s. The U.S. nuclear OpE program provides input parameters to the NRC Standardized Plant Analysis Risk models and the industry probabilistic risk assessment (PRA) models. While earlier PRA focuses were on at-power, internal event analysis, the risks from external hazards and during low power shutdown (LPSD) operation could be significant and the needs to develop LPSD PRA and external hazards PRA are on the rise. One issue in developing LPSD PRA is the reasonable estimation of shutdown initiative event (SDIE) frequencies. INL has developed and is maintaining an SDIE database for the NRC. However, this database is based on the reviewing of Licensee Event Reports (LERs), which is believed to be only a subset of “actual” shutdown initiating events occurred in the industry. This paper investigates a new approach to identify and characterize shutdown initiating events from the Institute of Nuclear Power Operations (INPO) industry database using machine learning techniques. The main process in this approach is to find out the relationship between key words in event descriptions and the SDIE categories as in the NRC SDIE database. The relationship can then be applied to the INPO database and search for SDIEs.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2025

HexWeather: Hexagonal Spatial Data Aggregation for Weather-Driven Grid Resilience Analysis

Extreme weather accounts for over 8 0 % of major U.S. power outages since 2000, highlighting the need for spatial tools that align weather data with the irregular boundaries of electric infrastructure. This paper introduces HexWeather, a modular, resolution-aware framework for aggregating historical and forecasted weather data using Uber's H3 hexagonal spatial indexing system. Unlike traditional methods that rely on state or county-level grids, HexWeather enables weather analysis across custom geographies such as utility service areas where public datasets are often unavailable or misaligned. Using Open-Meteo data, we evaluate how H3 resolution affects anomaly detection, spatial variability, and forecast uncertainty across three scales: state, county, and utility. Results show that while coarse resolutions suffice for broad trend tracking, finer resolutions are essential for identifying localized variability and operational risks. By applying metrics like Z-score standard deviation and interquartile range, HexWeather quantifies the spatial spread of both historical anomalies and forecasted conditions, allowing users to assess resolution adequacy for each analysis. This framework supports rapid weather data reuse, reproducible anomaly detection, and predictive modeling for infrastructure resilience. By bridging spatial misalignment in traditional datasets and enabling retrospective and forward-looking analysis within the same pipeline, HexWeather lays the groundwork for better post event analysis, outage prediction, and resilience planning.

Morris, Jacob [ORNL]↗
DOE OSTI2023

Adaptive, Active Learning, and Multifidelity Monte Carlo Methods in the MOOSE Stochastic Tools Module

MOOSE is an open-source computational platform for constructing multi-physics models and executing them in a massively parallel fashion. It has a stochastic tools module (STM) for forward/inverse uncertainty quantification (UQ) and surrogate modeling. This presentation details some recent developments to the STM with respect to the implementation of adaptive, active learning, and multifidelity Monte Carlo methods for forward UQ of computational models. Specifically, the adaptive Monte Carlo methods include Markov Chain Monte Carlo (MCMC)-driven algorithms like adaptive importance sampling and parallelized subset simulation for statistical QoI estimation, rare events analysis, and stochastic gradient-free optimization. The active learning methods include Gaussian Process (GP) surrogates and their training via Adam optimization, design of acquisition functions, and integration with samplers like Monte Carlo, adaptive importance, and parallelized subset simulation. These active learning methods are also designed to work in a batch mode, wherein, the required calls to the full computational model are executed in parallel whenever a user-specified batch size is met. The multifidelity methods in STM are broadly divided into two categories: hierarchical, where a defined hierarchy exists among the low-fidelity models, and peer, where all the low-fidelity models are treated equally. A GP surrogate is used to learn the differences between the low- and high-fidelity models in both multifidelity categories, and acquisition functions from the active learning classes are used to decide whether to rely on a low-fidelity model or call the expensive high-fidelity model. Alongside the software description and usage, applications are also presented to nuclear engineering computational models including a TRISO nuclear fuel particle, a reactor pressure vessel, and a heat-pipe microreactor.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Estimating the Contributions to Human Error Probability from the Convolution of the Distribution of Time Available and Time Required

As part of their duties, Human Reliability Analysis must often evaluate if crews in nuclear power plants (NPPs) can complete tasks associated with a human-failure event within time limits. For example, the time required in NPP scenarios is determined by systematic and structured walkthroughs, feasibility studies, recorded times from training exercises, and interviews with experienced operators and experts. Typically, a point estimate is derived for the estimate (mean, maximum, or 95th percentile of time required). Using point-estimate values can mask the risk associated with variability among crews, plant conditions and set-up, environmental conditions, and other impact factors under which these actions are executed. While point estimates for time required and time available have served the industry well, without considering the uncertainty they could lead to biased understanding about the risk. The Integrated Human Event Analysis System - General Methodology (IDHEAS-G) model (developed by the US Nuclear Regulatory Commission, NRC) for human error probability calculates human error probability by summing two probabilities: insufficient time and cognitive error. As such, the model takes a more holistic approach by considering the full distributions for time required and time available to calculate the human error probability because the time available to complete the task is insufficient. In this study, we expand on the work of the NRC and discuss methods for estimating these time considerations. For example, for the time required, the impact of Performance Influencing Factors (PIFs) on the distribution was divided into impacts that are aleatory in nature, such as crew-to-crew variability, and those that are epistemic (i.e., the PIFs). Starting with the factors that introduce aleatory uncertainty, a first-order distribution was developed from a large set of time required (i.e., NPP task completion times) data for the range of operator actions that occur in the NPP control room under simulated accident conditions. The first-order distribution can then be adjusted to account for epistemic uncertainty using research associated with the impact of applicable PIFs on the time required. We also develop guidance for analysts to address the probability distributions for the time available. The guidance we developed on how to estimate time required and time available distributions is based on the identification of pertinent research and data, data analyses, and expert knowledge elicitation.

human error probability, human performance, time e↗
DOE OSTI2023

Drivers of Cloud Condensation Nuclei in the Eastern North Atlantic as Observed at the ARM Site

Abstract Seven years of data collected at the Atmospheric Radiation Measurement's Eastern North Atlantic (ENA) site are analyzed to understand the controls of Cloud Condensation Nuclei (CCN) concentrations in the region. Day‐night differences in the aerosol data as segregated by wind direction demonstrate the aerosol observations to be impacted by local emissions when the wind direction (wdir) is between 90° and 310° (measured clockwise from the North where air is coming from). Data collected during marine conditions (wdir <90° or wdir >310°) show the CCN concentrations to be higher in the summer months as compared to the winter months. CCN budget analysis revealed advection and precipitation scavenging being primarily responsible for modulating the CCN concentrations at the site on monthly timescales, with rain rates driving the precipitation scavenging term. High (greater than 75th percentile) and low (lower than 25th percentile) CCN events were identified for each month to characterize the sub‐monthly variability of CCN concentrations. Low CCN events had thicker clouds, stronger rain rates, and lower reanalysis reported free‐tropospheric aerosol pseudo number concentration at the ENA site as compared to the high CCN events. Analysis of satellite data of air‐parcels 48 hr prior to their arrival at the ENA site demonstrated the air parcels during low CCN events to encounter higher cloudiness, stronger rain rates, and higher cloud top heights as compared to the high CCN events. The results presented herein provide key constraints for model evaluation studies and climatological studies conducted at the ENA site.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

BISON analysis of FeCrAl and Zircaloy cladding deformation during simulated BWR cyclic dryout conditions

The BISON fuel performance analysis code has been used to study FeCrAl and Zircaloy cladding performance to better understand cladding deformation behavior in boiling water reactors during conditions caused by anticipated operational occurrences (AOOs) or by anticipated transients without scram (ATWS). BISON models of novel separate effects tests simulating ATWS events predicted mechanical responses to thermal cycling boundary conditions. Here, we assessed FeCrAl and Zircaloy deformation and burst models to determine those best suited for cyclic dryout event analysis. In addition, we compared diametral strain profiles of the post-experiment claddings to simulation results. The capability of the BISON code for modeling BWR AOO or ATWS events is promising.

36 MATERIALS SCIENCE↗
DOE OSTI2026

Model-independent measurement of the Higgs boson associated production with two jets and decaying to a pair of W bosons in proton-proton collisions at $\sqrt{s}=13$ TeV

A model-independent measurement of the differential production cross section of the Higgs boson decaying into a pair of W bosons, with a final state including two jets produced in association, is presented. In the analysis, events are selected in which the decay products of the two W bosons consist of an electron, a muon, and missing transverse momentum. The model independence of the measurement is maximized by employing a discriminating variable, developed through machine learning, that is agnostic to the signal hypothesis. The analysis is based on proton-proton collision data at $\sqrt{s}=13$ TeV collected with the CMS detector from 2016–2018, corresponding to an integrated luminosity of 138 fb −1 . The production cross section is measured as a function of the difference in azimuthal angle between the two jets. The differential cross section measurements are used to constrain Higgs boson couplings within the standard model effective field theory framework.

Hadron-Hadron Scattering↗
DOE OSTI2020

Cause identification of electromagnetic transient events using spatiotemporal feature learning

This paper presents a spatiotemporal feature learning method for cause identification of electromagnetic transient events in power grids. The proposed method is formulated based on the availability of time-synchronized high-frequency measurements and using the convolutional neural network as the spatiotemporal feature representation along with softmax function for the classification. Despite the existing threshold-based, or energy-based events analysis methods, such as support vector machine autoencoder, and tapered multi-layer perceptron neural network, the proposed feature learning is carried out with respect to both time and space. The effectiveness of the proposed feature learning and the subsequent cause identification is validated through the Electromagnetic Transients Program (EMTP) simulation of different events such as line energization, capacitor bank energization, lightning, fault, and high-impedance fault in the IEEE 30-bus, and the real-time digital simulation of the Western System Coordinating Council (WSCC) 9-bus system.

42 ENGINEERING↗
DOE OSTI2022

Precursor Analysis Report: Remote Access Attack on Oldsmar Water Treatment Facility 2021

The Remote Access Attack on Oldsmar Water Treatment Facility 2021 Precursor Analysis Report leverages publicly available information about the Oldsmar cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. On 5 February 2021, an adversary gained unauthorized remote access to Bruce T. Haddock Water Treatment Plant in Oldsmar, Florida, which provides treated water to 15,000 customers. The adversary accessed the facility’s Supervisory Control and Data Acquisition (SCADA) workstation and human machine interface (HMI) to change the chemical concentration of sodium hydroxide, commonly referred to as lye and used to regulate acidity levels, from 100 parts per million (PPM) to 11,100 PPM. The chemical was raised to lethal levels that if ingested could lead to serious soft tissue damage, burns, or even death. The facility, however, had redundancies and alarms in place to alert personnel of dangerous chemical levels, and facility officials stated it would have taken 24 to 36 hours for the chemical changes to affect the water supply. Researchers and analysts identified six unique techniques utilized during the attack with a total of 23 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Four of the identified techniques used during the Oldsmar cyber attack were precursors to the triggering event. Analysis identified 21 observables associated with these precursor techniques, 20 of which were assessed to have an increased likelihood of being perceived in the minutes preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2022

Precursor Analysis Report: Doppelpaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019

The DoppelPaymer Ransomware Attack on Petroleos Mexicanos (PEMEX) 2019 Precursor Analysis Report leverages publicly available information about the PEMEX cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The 2019 DoppelPaymer ransomware attack on PEMEX, Mexico’s nationalized petroleum corporation, highlights a unique threat that ransomware and cybercriminal extortion poses to Operational Technology (OT) environments in critical infrastructure. The incident began with an employee downloading commodity malware that allowed adversaries to gain initial access to PEMEX’s enterprise environment. After conducting privilege escalation, tool ingress, and data exfiltration, the adversaries deployed DoppelPaymer ransomware throughout the PEMEX enterprise environment, resulting in the company having to take dozens of systems offline for at least several days. Although PEMEX stated that their operations were not affected, the data exfiltrated from PEMEX was made available for download on DoppelPaymer’s leak site, as well as on other illicit criminal forums. This stolen data included not only company information, but also sensitive OT-specific configuration data. This incident showcases how cybercriminal exfiltration and posting of sensitive OT architecture documentation can pose security concerns for the targeted organization for years due to the long lifespan of OT assets and architectures. Researchers and analysts identified 18 unique techniques utilized during the attack with a total of 190 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Fifteen of the identified techniques used during the DoppelPaymer ransomware attack were precursors to the triggering event. Analysis identified 163 observables associated with these precursor techniques, 34 of which were assessed to have an increased likelihood of being perceived in the 60 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2025

Precursor Analysis Report: Blackmatter Ransomware Attack on New Cooperative 2021

The BlackMatter Ransomware Attack on New Cooperative 2021 Precursor Analysis Report leverages publicly available information about the New Cooperative cyber attack and catalogs anomalous observables for each technique employed in the attack. This analysis is based upon the methodology of the Cybersecurity for the Operational Technology Environment (CyOTE) program. The BlackMatter ransomware was first identified in July 2021 and is reported to have infected more than 50 corporations around the world. , The Iowa-based grain cooperative, New Cooperative, was impacted by the BlackMatter ransomware on or before 18 September 2021. The adversary likely resided on New Cooperative’s networks for 15 days prior to encrypting its network and demanding New Cooperative pay $5.9 million in ransom by 25 September to unlock systems and prevent 1 terabyte (TB) of sensitive data from being publicly released. It is not clear if New Cooperative paid the ransom. The full impact of the ransomware attack is not known; however, according to New Cooperative’s general manager, the attack caused the company’s automated processes to revert back to processes used in the 1970s. , As of 6 October, only 50 percent of New Cooperative’s operations were utilizing automated processes. The company took eight weeks to rebuild the entire network and information technology (IT) systems from the ground up, which puts the date of fully recovery around 13 November. Researchers and analysts identified 20 unique techniques utilized during the attack with a total of 404 observables using MITRE ATT&CK® for Industrial Control Systems. The CyOTE program assesses observables accompanying techniques used prior to the triggering event to identify opportunities to detect malicious activity. If observables accompanying the attack techniques are perceived and investigated prior to the triggering event, earlier comprehension of malicious activity can take place. Seventeen of the identified techniques used during the New Cooperative cyber attack were precursors to the triggering event. Analysis identified 360 observables associated with these precursor techniques, 284 of which were assessed to have an increased likelihood of being perceived in the 15 days preceding the triggering event. The response and comprehension time could have been reduced if the observables had been identified earlier. The information gathered in this report contributes to a library of observables tied to a repository of artifacts, data sources, and technique detection references for practitioners and developers to support the comprehension of indicators of attack. Asset owners and operators can use these products if they experience similar observables or to prepare for comparable scenarios.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗