CISA, FBI Warn Iranian Hackers Target U.S. Infrastructure

State-directed actors tied to Iran's IRGC use "Ghost Display" tactics to manipulate automated tank gauges, blinding defenders to physical leaks and supply shortages.

Gallery: The "Ghost Display" Threat on U.S. Infrastructure

A joint federal intelligence advisory from the Cybersecurity and Infrastructure Security Agency and the FBI unmasks a widespread, state-directed cyber offensive that targets vulnerable operational technology across multiple critical U.S. industries.Federal authorities confirm that sophisticated threat actors successfully compromise internet-exposed Automatic Tank Gauge systems. These critical monitoring devices see wide utilization across the domestic energy, agriculture, transportation, and chemical sectors. Facilities rely heavily on these systems to measure fluid levels, track industrial inventory, regulate internal temperatures, and detect hazardous chemical leaks in massive storage tanks.

The exploitation profile reveals a highly calculated approach to breaching vital facility networks. Attackers use command execution, privilege escalation, and SQL injection techniques to bypass standard authentication protocols. They primarily gain initial entry via unpatched systems or by exploiting hardcoded default credentials that facility operators routinely fail to update upon initial installation.

Rather than deploying traditional ransomware or actively destroying physical hardware, the operators employ a more insidious, covert tactic. The attackers modify deep configuration parameters within the compromised systems to disable critical safety alerts. Furthermore, they actively manipulate the display data that human facility operators rely upon for daily safety assessments and operational decisions.CISA emphasizes that obscuring these vital monitoring tools provides the threat actors with dangerous physical capabilities. The digital manipulation allows attackers to successfully hide an active, physical fluid leak or dangerous pressure build-up from facility staff. Alternatively, the false data gives them the power to trigger localized logistics and supply panics by artificially reporting empty fuel tanks or sudden, unexplained inventory drops.This specific tradecraft closely aligns with the broader “Ghost Display” doctrine. Security analysts observe this deceptive doctrine in ongoing operations deployed by CyberAv3ngers, a prominent threat group linked directly to Iran’s Islamic Revolutionary Guard Corps.CyberAv3ngers continues to heavily target Rockwell Automation and Allen-Bradley programmable logic controllers across U.S. water and municipal utilities. In those parallel attacks, the group also feeds false “safe” metrics to human operators while maintaining unauthorized access to the underlying infrastructure, effectively blinding the defenders to the reality of their own systems.

The joint advisory underscores the escalating vulnerability of operational technology as critical industries increasingly connect legacy industrial control systems to the public internet for remote monitoring. CISA strongly urges all infrastructure operators within the energy, chemical, and agricultural sectors to immediately audit their networks and disconnect all gauge systems from the public-facing internet.

Furthermore, authorities mandate that facilities aggressively implement strict multi-factor authentication, immediately update all default administrative passwords, and apply the latest vendor security patches to prevent further exploitation. Federal intelligence agencies continue to monitor the affected sectors for further anomalous activity while infrastructure defenders rush to secure exposed industrial supply chains before a major physical incident occurs.

---

---