IC Technology & Surveillance — 2026-06-04

CISA FBI and NSA Warn of Active Cyberattacks Targeting US Fuel Tank Monitoring Systems

BLUFPublic attribution of the ATG campaign remains unlikely within 90 days, leaving critical infrastructure operators to harden internet-exposed fuel systems without actor-specific threat intelligence.

CISA, FBI, NSA, DOE, EPA, TSA, DOT, and USDA issued a joint advisory on June 2 confirming active attacks against internet-exposed ATG systems across the Energy, Chemical, Food and Agriculture, and Transportation sectors 12. Observed TTPs include authentication bypass via hardcoded credentials, OS command execution, SQL injection, and privilege escalation; post-compromise capabilities include manipulating pump controls and disabling safety alerts, with observed breaches involving manipulation of display settings rather than actual tank contents 12. The U.S. government has not attributed the activity to any nation-state or threat actor group; CNN reported May 15 that Iranian actors exploiting default-password Veeder-Root ATG consoles are the top suspect, with Tennessee documenting one chain with 15 affected tanks, preceded by two EMA sector-wide advisories in April coordinating with DOE CESER and CISA 3. Recommended mitigations include removing ATG systems from direct internet exposure, replacing default credentials, and implementing phishing-resistant MFA 12.

Analysis
The eight-agency advisory confirms active ATG compromise with post-access capability to suppress safety alerts and falsify tank-level readings, while leaving mitigations voluntary absent any sector-wide mandate. Public attribution within 90 days of the June 2 advisory is unlikely at moderate confidence, grounded in the advisory's explicit non-attribution posture and acknowledged sparse forensic artifacts. Without a named actor, sector defenders cannot prioritize against specific TTPs and must apply uniform hardening across all internet-exposed deployments. Iranian actors exploiting default-password Veeder-Root consoles remain the leading suspect, but the divergence between official silence and what non-public collection may already confirm could reflect diplomatic timing rather than evidentiary absence. Should attribution resolve publicly, sector SRMAs face pressure toward mandatory directives; absent it, voluntary compliance persists and operators retain no forcing function.
4 sources
  1. CISA and Partners Urge Hardening Automatic Tank Gauge Systems
  2. CISA and Partners Urge Hardening Automatic Tank Gauge Systems (Joint CSA) - FBI IC3
  3. CISA warns of cyberattacks targeting fuel tank monitoring systems - BleepingComputer
  4. CISA and Partners Warns of Cyberattacks Targeting U.S.-based Automatic Tank Gauge Systems - CyberSecurityNews

View in full brief →

UNCLASSIFIED // OPEN SOURCE