Loading story…
Internet-exposed Automatic Tank Gauge (ATG) systems in the United States fell sharply after industry and government warnings about active attacks against unprotected fuel monitoring consoles. BitSight reported that U.S. exposure on the ATG protocol dropped about 56% from its March 2026 peak to June, while global exposure declined 49%, with most of the reduction concentrated in the U.S. The decline followed alerts from the Energy Marketers of America, the Tennessee Fuel & Convenience Store Association, DOE CESER, and CISA, which urged operators to harden ATG deployments.
BitSight said the reduction appears to reflect real remediation rather than scanning anomalies, citing churn analysis, port-hopping checks, and comparison against control traffic on port 8001. A second dataset tracking confirmed vulnerable web-facing ATGs showed a smaller but similar decline beginning in April, although some devices resurfaced in June. Officials and researchers warned that significant risk remains because many ATGs are still reachable over 10001, 8001, or web interfaces, and moving systems behind VPNs, NAT, or firewalls may reduce visibility without fixing the underlying vulnerabilities or potential physical-world impact.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
On June 2, 2026, CISA and seven other federal agencies published a joint fact sheet recommending strong passwords and removal of Automatic Tank Gauges from the public internet. The guidance followed the spring 2026 ATG attack activity and provided concrete mitigation steps for operators.
By June 2026, Bitsight observed that U.S. internet-exposed ATG systems had fallen 56% from their March 2026 peak, while global exposure fell 49%. Bitsight linked the sustained three-month decline to remediation following the April attack advisories rather than scan noise.
In May 2026, CNN reported on suspected Iran-linked intrusions targeting internet-connected Automatic Tank Gauges in the United States. The reporting connected the campaign to the attack activity that had prompted April advisories.
On April 14, 2026, the Energy Marketers of America warned of active attacks on Automatic Tank Gauges in Tennessee and nationwide. The advisory said unprotected ATG consoles were the primary targets and noted that many suspected Iran was behind the attacks.
Around April 30, 2026, a follow-up advisory reported by the Tennessee Fuel & Convenience Store Association and republished by the Texas Food & Fuel Association reiterated coordination among industry groups, DOE CESER, and CISA. The notice continued the response to the ATG attack activity disclosed earlier in April.
Bitsight reported that internet-exposed Automatic Tank Gauge systems in the United States peaked in March 2026 before beginning a sharp decline. This peak became the baseline for later measurements showing a 56% drop by June 2026.
In 2025, Bitsight said it identified five additional vulnerabilities affecting Automatic Tank Gauge systems. Across its ATG research, Bitsight said the findings included five high-severity and ten critical vulnerabilities.
In September 2024, Bitsight TRACE reported finding 10 zero-day vulnerabilities across six Automatic Tank Gauge systems from five vendors. The research highlighted serious security weaknesses in internet-connected fuel gauge infrastructure.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcemalware.news
Open sourcebitsight.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Suspected Iranian hackers breached internet-exposed automatic tank gauge (ATG) systems at gas stations in several U.S. states, reportedly targeting **Veeder-Root** `TLS-350` and `TLS-450 Plus` consoles that lacked password protection rather than exploiting a newly disclosed flaw. Advisories said incidents affected sites in Tennessee, including one convenience store chain with 15 tanks impacted, and in some cases attackers deleted fuel tank and sensor data or altered system settings. Officials said no physical damage was reported, but security experts warned that compromised ATGs could enable fuel overfills, disable safety alarms, and cause environmental or equipment damage. The intrusions come amid a broader surge in attacks on operational technology across industrial sectors. NCC Group said industrial organizations suffered **2,073 ransomware attacks** in the 12 months to March 2026, accounting for **30% of all ransomware activity**, with manufacturers of capital goods, machinery, construction, and engineering among the hardest hit. The report said many organizations still prioritize IT defenses over OT security even as governments and regulators expand resilience requirements, while international authorities have issued procurement guidance to push stronger security controls into OT products and supply chains.
Aug 7, 2026
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
A critical command injection vulnerability, tracked as CVE-2025-58428, has been identified in the Veeder-Root TLS4B Automatic Tank Gauge (ATG) System. The flaw resides in the system's SOAP-based web services interface, which allows remote attackers with valid credentials to execute arbitrary system-level commands on the underlying Linux operating system. Successful exploitation could grant attackers full shell access, enable remote command execution, and facilitate lateral movement within affected networks, posing a significant risk to organizations relying on these systems for fuel management and monitoring. Security advisories highlight that all versions of the TLS4B system prior to 11.A are affected. In addition to the command injection issue, the system is also vulnerable to an integer overflow related to Unix time handling, which could cause system resets after the 2038 epoch rollover. The vulnerabilities are rated as critical, with CVSS scores of 9.9 (v3.1) and 9.4 (v4), and could result in denial of service, administrative lockout, or disruption of core functionalities if exploited. Organizations are urged to review vendor guidance and apply mitigations to protect against these threats.
Jun 29, 2026