CISA Warns of Cyberattacks Targeting U.S. Tank Gauge Systems

The Cybersecurity and Infrastructure Security Agency (CISA), alongside the FBI, NSA, Department of Energy, EPA, TSA, Department of Transportation, and USDA, has issued a joint warning ongoing cyberattacks targeting automatic tank gauge (ATG) systems across the United States.

These systems are critical components used in energy, chemical, food and agriculture, and transportation sectors to monitor storage tanks, including fuel levels, temperature, and leak detection.

According to the advisory, threat actors are actively scanning for and compromising internet-exposed ATG systems.

While the activity has not yet been attributed to any specific nation-state or threat group, the observed behavior indicates deliberate exploitation of weak security controls and exposed interfaces. Once accessed, attackers are able to execute commands remotely and manipulate system configurations.

The agencies highlight several common attack vectors used in these intrusions. These include authentication bypass techniques and the abuse of hardcoded or default credentials, which allow unauthorized access to management interfaces.

CISA said in a report shared with GBhackers , attackers are also leveraging operating system command execution vulnerabilities and SQL injection flaws to run arbitrary commands and tamper with backend databases.

In more advanced scenarios, privilege escalation techniques are used to gain full administrative control over both the application and underlying operating system.

Successful compromise of ATG systems can have serious operational and safety consequences. Threat actors with access to these systems can modify critical parameters such as tank volumes, product identifiers, and pump controls. This level of manipulation can disrupt normal operations and potentially lead to incorrect system behavior.

For example, altering tank level readings could create a denial-of-view condition, preventing operators from accurately monitoring fuel levels and increasing the risk of overflows or shortages.

Additionally, attackers may disable system alerts and alarms, significantly reducing an organization’s ability to detect faults or hazardous conditions. This creates increased risk of environmental damage, such as undetected leaks, and physical hazards linked to equipment malfunction.

The advisory emphasizes that these cyber intrusions can effectively give attackers the same level of control as someone physically operating the system console.

Many ATG devices use default TCP ports such as 8001, 9001, and 10001, which should never be accessible externally. Instead, organizations should restrict access through firewalls, access control lists, or secure VPN connections .

To mitigate these risks, the authoring organizations strongly urge ATG operators to eliminate direct exposure of their systems to the public internet.

Credential security is another critical focus area. Operators are advised to immediately change default passwords and implement strong, unique credentials across all interfaces. Where possible, phishing-resistant multi-factor authentication should be deployed to further protect access.

The agencies also recommend working with certified service providers to ensure systems are updated with the latest patches and security configurations.

Continuous monitoring is essential, including enabling logging and auditing to detect unauthorized access attempts, suspicious configuration changes, and abnormal system behavior.

Finally, organizations are encouraged to report any suspected incidents to CISA through its reporting portal and collaborate with third-party service providers to adopt established operational technology security practices.

This coordinated advisory underscores the growing threat to industrial control systems and highlights the need for improved cybersecurity hygiene across critical infrastructure environments.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

A newly analyzed leak tied to The Gentlemen ransomware group reveals how modern ransomware operations…

A critical security flaw in the Kirki – Freeform Page Builder, Website Builder & Customizer…

Expiring Microsoft Secure Boot keys will not brick unmigrated systems on June 27, 2026. However,…

Apache ActiveMQ users are being urged to apply immediate patches following the disclosure of a…

Analysis has revealed that 38% of organizations are running GitHub Actions workflows vulnerable to script…

Ivanti has patched a high-severity vulnerability in its Ivanti Neurons for ITSM platform that could…