WASHINGTON — U.S. cybersecurity agencies have warned of increased cyber threats targeting the energy sector and other critical infrastructure, urging operators to strengthen defenses against attacks on internet-connected operational technology and fuel storage monitoring systems, according to a series of joint advisories issued in recent weeks and earlier this year.
The warnings underscore growing concern among U.S. authorities that operational technology used to manage energy production, storage and distribution remains an attractive target for malicious cyber actors. Federal agencies said recent activity has involved attempts to compromise internet-exposed industrial control devices that support essential services, while separate advisories highlighted broader risks to operational technology across critical infrastructure sectors.
In a joint fact sheet published in early June, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the Department of Energy (DOE), and several other U.S. agencies said they had observed malicious cyber activity targeting automatic tank gauge systems used to monitor fuel and liquid storage tanks.
According to the advisory, the affected systems are deployed across the energy, chemical, food and agriculture, and transportation sectors to monitor storage tank levels, temperatures and potential leaks. The agencies said attackers had targeted internet-exposed devices and modified system settings through command execution. They added that the activity had not been attributed to a specific nation-state or threat group.
"The recent malicious cyber activity observed by the authoring organizations—which the U.S. government has not yet attributed to a nation-state or threat actor group—involves cyber threat actors compromising internet-exposed ATG systems and subsequently modifying them through command execution," the advisory said.
Earlier in April, CISA, the FBI, the NSA, the Environmental Protection Agency, the DOE and other federal partners also warned of ongoing exploitation of internet-connected operational technology devices, including programmable logic controllers used across U.S. critical infrastructure. The agencies said organizations had reported operational disruptions and financial losses linked to the activity and urged operators to remove unnecessary internet exposure, strengthen authentication controls and follow established incident reporting procedures.
Separately, cybersecurity authorities from the Five Eyes intelligence alliance said this month that advances in artificial intelligence are expected to accelerate both offensive and defensive cyber capabilities, increasing the urgency for governments and businesses to improve cyber resilience. Officials recommended reducing attack surfaces, maintaining software updates and strengthening access controls as part of broader defensive measures.
The latest official advisories remain in effect, and U.S. agencies continue to encourage organizations in the energy sector and other critical infrastructure industries to review recommended mitigations and report suspected cyber incidents through established federal reporting channels.
