Thousands of Exposed Fuel Gauges Just Left the Internet

Most of the exposure research we publish goes one way. We count some category of internet-exposed devices, the number is bigger than you hoped, and it is climbing. Webcams. Industrial control systems. NTP servers old enough to vote. The story is almost always "there is more of this exposed than there should be, and it is getting worse."

This one goes the other way. There was a dramatic drop in exposure and a drop like that is worth a careful look before anyone celebrates. Over the last 3 months we have observed internet-exposed Automatic Tank Gauge (ATG) systems in the United States fall by more than half. From March to June, there was over a 55% drop in exposed IP addresses. Globally, exposure fell 49% from that same March peak, with the US accounting for most of the decline.

Good news? Definitely, and about time! The work of raising awareness on the dangers of exposing ATGs in the open internet started more than 10 years ago. But we must beware, not everything is addressed and new dangers are still lurking.

Why should you care about a fuel gauge?

An ATG is the little computer that watches a fuel tank. It tracks how much is in there, the temperature, moisture, and, importantly, whether the tank is leaking. It can also control many processes surrounding the tank, like alarms and fume extractors. You will find them under every gas station but also in places that need to keep a large volume of fuel on site: airports, hospitals, military bases, power plants, data centers, and any critical infrastructure that needs a backup energy generator.

Back in September 2024, Bitsight TRACE took apart six of these systems from five vendors and found 10 zero-day vulnerabilities (full research here). In 2025, five more. Five high, ten critical vulnerabilities. We also proved that physical damage was possible for attackers: we drove a connected relay well past its duty cycle to see what would happen physically. It burned out. Turns out that if you drive a relay fast enough under enough load, it stops being a relay and briefly becomes a lightbulb (once the magic smoke is out, it is neither).

The point being: an exposed ATG, which usually sits in critical infrastructure, is a physical-world problem. With access, someone can alter tank readings, disable alarms, and, as we found in the lab, even damage the device or the connected peripherals. Because of this, a change in how many are exposed is worth measuring carefully, especially since the warnings about exposure have been persistent throughout the years with no apparent change in the landscape. Until now.

What we set out to answer

Back in May, CNN reported suspected Iran-linked intrusions against internet-connected ATGs in the US. But the warning signs surfaced weeks earlier through industry channels. On April 14, the Energy Marketers of America (EMA) issued an urgent advisory reporting active attacks on ATGs in Tennessee and nationwide, naming unprotected ATG consoles as the primary targets and noting that many suspected Iran. That same advisory disclosed that EMA and the Tennessee Fuel & Convenience Store Association were already working with the DOE's CESER office and CISA (the US Cybersecurity and Infrastructure Security Agency) to coordinate a response. A follow-up advisory around April 30, reported by TFCA and republished by the Texas Food & Fuel Association, reiterated the interagency coordination.

Bitsight observed that the exposed population dropped over the same months.

That leaves two questions we can actually test against the data. Is exposure genuinely going down, or are we being fooled by measurement noise? And if it is going down, does it stay down?

What are we looking for

Bitsight scans the internet continuously through our Groma engine, and the ATG vulnerabilities in play here came out of our own ICS lab, so this is our data end to end, from the raw scans to the CVEs. For an initial first view we focused on two TCP ports that are known to have devices replying with the ATG protocol (10001, 8001). We did scan for other ports, but we will focus on these two as they are the most significant ones for the purposes of this study. 

A word on port 10001, because it is a small piece of computing history. The command set most of these devices still speak traces back to Veeder-Root's TLS-300 and TLS-350 consoles, which defined a serial (RS-232) protocol decades ago. When people started putting these on networks, they bridged that serial line to TCP, very often through a Lantronix serial-to-Ethernet adapter whose default listening port is 10001. So an entire class of safety-critical infrastructure is reachable on port 10001 today essentially because that was one hardware vendor's factory default(!). That is how these things go.

Our unit of measure is the unique IPv4 address seen per month. We aggregate by month so a full scan cycle completes inside each bucket and it is a good baseline for comparisons. Our analysis covers June 2025 to June 2026.

A few caveats before you trust those numbers:

• We parse proper protocol responses, not just service banners. Known honeypots are actively avoided to the extent of the possible.
• This is the ATG protocol-port view. There are HTTP consoles which expose only a web server and they are a second surface. We scan those too, in its own section below.
• Owner attribution is present for about 45 percent of IPs globally (36 percent in the US), so owner-level cuts describe the attributed slice. Geolocation is solid at the country and city level.

What we observed: The drop

For ten months, from June 2025 through March 2026, the US held a band of roughly 4,300 to 5,300 unique exposed IPs, averaging 4,815 across 2025. Then April fell 27.6% in a single month, May fell another 31.8%, and June continued down. By June the exposed population was 56% below the March peak.

The year of flat baseline changed dramatically since last April. Ten months in a narrow band, then three consecutive months of decline. Against a flat baseline, the April break really stands out cleanly rather than blending into ordinary month-to-month movement.

The rest of the world moved the same direction but more gently. Non-US exposure fell about 26% over the window, against 56% for the US alone, so the change seems to clearly have concentrated in the country that was reportedly targeted. 

Real decrease

A falling count is easy to misread. Everyone scanning the Internet knows sometimes scan results vary a lot. In addition, many of these devices live on residential and small-business broadband, where ISPs hand out fresh addresses all the time. So a device that merely got a new IP looks, in a January-versus-June comparison, the same as a device taken offline. IP churn can look like remediation.

Fortunately, this dataset supplies a control scan. Port 10001 carries about 84% of what we see. Port 8001 has its own small, steady population, scanned by the same infrastructure, over the same months, on the same kinds of networks. If churn or scan coverage were driving the port-10001 drop, port 8001 should show it too.

But it barely moved. Over the window, port 10001 in the US fell 65% (4,214 unique IPs to 1,466). Port 8001 fell 4% (885 to 849). Same scanner, same networks, same calendar, and one collapses while the other holds. Churn and scan noise would hit both ports, so they do not account for what emptied port 10001.

The control also gives a churn estimate. About 20% of port 8001's January addresses were gone by June even though its total held steady. Apply that same rate to port 10001 and roughly 870 of its 3,127 vanished addresses are consistent with reassignment, leaving about 2,260, close to three-quarters, as genuine removals. (That is an estimate. It assumes the two populations churn at similar rates, which is an approximation.)

One more check addresses port-hopping rather than churn. Of the 3,127 addresses that left port 10001 between January and June, 13 (0.4%) reappeared on any of the other ATG ports we watch. So it is not port-hopping either.

Lasting change

A one-month drop can be a blip: operators react to an advisory, pull a few consoles, then drift back once attention fades. But current exposure sits below the entire prior year's floor for a third straight month and is still going down. Three consecutive months under the 2025 baseline, still declining, is most likely the signature of a sustained change rather than a panic reaction.

Taken together, the observations line up in one direction: the timing overlaps with the advisory cycle and precedes the general public reporting, the decline is a step change against a year of flat baseline, a flat control port rules out churn and scan coverage as the cause of the count drop, the vanished addresses did not resurface on other observed ports, and the drop has held for a quarter. 

That pattern seems consistent with operators acting on the advisories. 

Remediations like this don’t happen all the time. In fact, it’s pretty unusual for us to see such a significant exposure drop-off in a short period of time. There are likely many reasons to explain why this remediation was successful and many people/organizations to credit, from both public and private sector, including CISA, US law enforcement, integrators, and operators. Their efforts should be commended and studied as examples for future responses. 

There be dragons

Two things may keep this from being a clean win.

Firstly: visibility is not the same measurement as vulnerability. Exposure is what answers an internet scan. Vulnerability is what a device would do if someone reached it. A console moved behind a VPN (virtual private network), a NAT (network address translation) gateway, or a carrier firewall is still running, still an ATG, and still vulnerable if it is one of the affected models. It has simply stopped answering scans from the outside, which is the recommended fix, and it's a good thing. But know that lateral movement is the primary way threat actors compromise Industrial Control Systems and those ATGs will still be vulnerable to a threat actor that gets inside your internal network.

Secondly: there is still a good chunk that is still exposed. Port 8001 was never touched. The reduction landed almost entirely on port 10001. Port 8001 still showed over 800 exposed US addresses in June, essentially where it began the year. Whatever outreach cleared port 10001 did not reach that population, and nothing in the data suggests it is being addressed. Owners might be under the impression that they are safe because they use another port. They are not.

The counts above are the ATG protocol port surface. More modern ATGs, those that have a console running on a webserver (HTTP and HTTPS, let’s loosely call them web-facing), a group that includes many devices still on default credentials, are a second surface. We scan for those too.

The web-facing gauges

The port view measures exposure. This second scan group measures both exposure and vulnerability directly. Across the same year, we tested web-facing ATGs against the known CVEs from our previous research and counted the hosts where a flaw is present, so every IP here is a confirmed vulnerable console. And keep in mind these are just a subset of the total ATGs that expose a web interface.

This dataset holds 2,644 unique confirmed vulnerable IPs over the thirteen months. Because a device can listen on any port, here we count every vulnerable host regardless of which port it answered on. By coincidence or legacy reasons, port 10001 is also used to expose the web interface on many ATGs. Maybe because an integrator is able to freely choose which port the device is set to run the web interface and he always used port 10001 in the past for the legacy ATG protocol, he would likely choose the same port.

The shape is somewhat similar with the exposure data, although a bit more faint. For ten months the US vulnerable population held a band around 448 IPs a month. April pulled it to 259 and May to 235, the same two months as the advisory cycle. June then rebounded to 320. Even so, April, May, and June all sit below the entire prior year's floor.

This year, in the US, port 10001 accounts for the bulk of the web-facing vulnerable population, about 455 of January's 522 vulnerable IPs, and it carries most of the absolute decline. The other web ports did not hold flat the way port 8001 did in the ATG protocol exposure data. Taken together they fell about 38% from January to June, close to port 10001's 40%. So on the web side the decline is spread across ports.

The port-hopping check comes out the same as before. Only about 7% of the US vulnerable IPs ever appear on more than one port, and hardly any look like they shifted off 10001 to another port over time. The devices that left did not resurface elsewhere in the data.

Of June's 320 US vulnerable IPs, only 12 are genuinely new, never seen in the prior year. The rest had been seen before, most of them simply reappearing after a month or two out of view. The bounce is the same long-standing devices flickering back, and because addresses are dynamic, even that handful overstates how many are truly new.

Two honest limits on reading this. Because the scan is filtered to vulnerable hosts, it has no flat comparison group to anchor it the way port 8001 anchored the exposure analysis, and at the IP level the vulnerable population churns. We leaned on the year-long baseline and the port-hopping check instead. We should read the US web signal as a fainter echo of the same April move, with the June uptick looking more like the same devices flickering back into view than a real reversal.

Where that leaves us

We observed a large, fast reduction in internet-exposed fuel gauges that then held for three months, concentrated in the country reportedly targeted, in the months of the advisories, and mostly on the single port operators were warned about. The reduction survived a churn control and a port-hopping check. A second scan of the confirmed vulnerable web-facing consoles shows a fainter version of the same April dip, again concentrated in the US. 

Kudos to all the individuals and teams who contributed to making this remediation effort a notable success. The participants involved, including CISA, law enforcement, industry associations, integrators and operators, and others, clearly departed from standard practices to achieve this outcome. It is vital that we analyze the underlying drivers of this success, exploring which specific factors, notifications, and participants most heavily influenced the remediation rate. Ultimately, this serves as an important reminder that government entities like CISA must systematically measure risk reduction and remediation rates moving forward to determine best practices and continually accelerate the remediation curve. 

But it is important to note that the job is not finished. We must not drop our guard. There is a more recent fact sheet by CISA and other organizations that we suggest everyone in this ecosystem read describing threats and mitigations. Devices moved behind a firewall are safer but are still present. Port 8001 was left alone. The web-facing vulnerable consoles dipped and then partly bounced back, and hundreds stayed confirmed vulnerable through June. Thousands of ATGs, exposed or vulnerable, are still reachable. Our scanning runs continuously, so we will see where the numbers go next. 

If you run one of these, or you buy fuel from someone who does (so, all of us), the ask has not changed since 2024, well, since 2015: an ATG has no business answering the open internet, on any port or protocol. Go and check. And if you find one, take it off and keep it off.