# Critical Infrastructure at Risk: CISA Warns of Widening Cyberattacks on Fuel Tank Monitoring Systems


## The Threat


The U.S. Cybersecurity and Infrastructure Security Agency (CISA), working alongside the FBI, NSA, Department of Energy, and other federal partners, has issued an urgent warning about sustained cyberattacks targeting automatic tank gauge (ATG) systems—the infrastructure backbone for monitoring fuel and liquid storage across critical sectors. These attacks represent a concerning shift toward targeting the instrumentation that keeps industrial operations running safely, rather than the facilities themselves.


ATG systems are deployed extensively in the Energy, Chemical, Food and Agriculture, and Transportation Systems sectors, where they serve as the remote monitoring nerve center for storage tank operations. These systems track tank levels, temperatures, and leak detection in real time. Operators depend on them to prevent environmental disasters and equipment failures. Yet according to the government warning, threat actors have discovered that many of these systems are exposed directly to the internet, protected by weak or nonexistent authentication, and riddled with exploitable vulnerabilities—making them an easy foothold for intrusion.


The active campaign involves threat actors compromising these exposed systems and executing commands that fundamentally alter their behavior. Attackers are disabling alerts, manipulating tank volume readings, modifying pump controls, and changing network settings. The damage isn't necessarily immediate or explosive—it's subtle and dangerous. When operators cannot see accurate tank levels or rely on alerts that have been silenced, the conditions are set for leaks, spills, equipment damage, and supply chain disruptions. The fact that no specific attacker has been attributed yet only underscores how difficult forensic attribution has become in these lower-profile but strategically significant operations.


## Severity and Impact


| Attribute | Details |

|-----------|---------|

| Advisory Type | Multi-vulnerability campaign (unattributed) |

| Affected Systems | Automatic Tank Gauge (ATG) systems, multiple vendors |

| Primary CVEs | Multiple: Authentication bypass, hardcoded credentials, OS command injection, SQL injection, privilege escalation |

| Estimated CVSS Range | 7.0–9.8 (High to Critical, depending on specific vulnerability) |

| Attack Vector | Network (internet-exposed systems) |

| Attack Complexity | Low (default credentials, known bypasses) |

| Authentication Required | None (initial compromise exploits lack of authentication) |

| Privilege Escalation | Yes, often achievable post-compromise |

| Affected Sectors | Energy, Chemical, Food & Agriculture, Transportation Systems |

| User Impact | Ability to disable alerts, manipulate readings, control pump operations, prevent leak detection |


## Affected Products


CISA's advisory does not identify specific ATG vendor products by name; however, the vulnerabilities exploited are common across many commercial ATG systems. Organizations should immediately audit their deployments to identify which specific systems they operate. Common vulnerability patterns include:


  • Authentication Bypass Flaws: Default or missing authentication on configuration endpoints
  • Hardcoded Credentials: Manufacturer-embedded usernames and passwords in firmware
  • Operating System Command Injection: Unvalidated input passed to shell commands
  • SQL Injection: Improperly parameterized database queries in monitoring interfaces
  • Privilege Escalation Vulnerabilities: Local escalation from unprivileged to administrative access

    • Organizations using internet-exposed ATG systems from any vendor—including but not limited to legacy and modern installations—should assume they are at risk until proven otherwise.


    ## Mitigations


    CISA and its federal partners recommend immediate action across these dimensions:


    Network Segmentation & Access Control

  • Remove ATG systems from direct internet exposure immediately
  • Place all tank gauge systems behind firewalls and access control lists
  • Restrict remote access exclusively through VPNs with strong authentication
  • Implement network segmentation so ATG systems do not directly communicate with external networks

    • Authentication & Credentials

  • Replace all default and hardcoded passwords with strong, unique credentials
  • Enforce multifactor authentication (MFA) on all remote access to ATG systems
  • Audit and document all accounts with access to these systems

    • Patch Management

  • Apply all available security updates from your ATG system vendor immediately
  • Establish a schedule for ongoing firmware updates and security patches
  • If updates are unavailable for legacy systems, prioritize replacement or deeper network isolation

    • Monitoring & Detection

  • Implement continuous monitoring for unauthorized configuration changes
  • Log all access attempts and command executions on ATG systems
  • Set up alerts for anomalous activity, particularly changes to tank volume settings, alert thresholds, or pump controls
  • Review logs for evidence of prior compromise

    • Operational Resilience

  • Conduct tabletop exercises to understand how compromised ATG readings would affect operations
  • Establish manual verification procedures for critical tank level readings
  • Test backup alert mechanisms independent of electronic systems

    • ## References


  • CISA Advisory: https://www.cisa.gov/news-events/alerts/2026/06/03/cisa-warns-cyberattacks-targeting-fuel-tank-monitoring-systems
  • FBI & NSA Joint Guidance: https://www.fbi.gov/investigate/cyber
  • Department of Energy Resources: https://www.energy.gov/security
  • CNN Investigation (May 2026): Iranian hackers targeted ATG systems at gas stations

    • ---


    ## HackWire Analysis


    This campaign reveals a critical vulnerability in how American critical infrastructure is defended: basic operational security failures are being weaponized with surgical precision. CISA's warning doesn't describe a zero-day exploitation frenzy or a sophisticated supply-chain compromise. It describes internet-exposed systems running with default passwords and unpatched vulnerabilities. Yet the potential consequences—silent manipulation of safety-critical readings—are profound enough to trigger a joint warning from five federal agencies.


    The Iranian connection, reported by CNN in May, fits a well-documented pattern. Iran has long prioritized industrial control systems as targets, particularly those affecting energy and transportation infrastructure. Previous Iranian-linked campaigns have targeted critical systems with a preference for low-signature intrusions that disrupt operations without triggering immediate alarms. Modifying ATG readings while leaving physical infrastructure untouched follows that playbook: operators see what appears to be normal operation while loss of visibility into tank levels increases the risk of environmental and safety failures.


    What makes this threat particularly dangerous is its invisibility. Unlike ransomware that announces itself with a payment demand, or destructive wiper attacks that leave unmistakable forensic evidence, ATG compromise is corrosive and quiet. An operator receives no dramatic alert. Instead, they slowly lose trust in the very instrument that is supposed to keep them informed. In industrial settings, this creates cascading second-order effects: missed leak detection, prevented maintenance, equipment stress, supply chain surprise, or environmental contamination.


    The broader lesson is uncomfortable: thousands of industrial facilities across the United States have deployed remote monitoring and control systems behind whatever firewall or authentication model was convenient in 2010. The rise of internet connectivity in industrial environments has not been matched by corresponding investments in security architecture. This advisory is not an outlier; it is a wake-up call that asset owners have let defenders play catch-up for far too long. Organizations must act immediately to understand their ATG footprint, isolate it, and harden it. Waiting for a specific vulnerability to be named and patched is no longer a viable strategy.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Critical Infrastructure](https://www.hackwire.news/category/critical-infrastructure) and [Government Advisories](https://www.hackwire.news/category/government-advisories)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)