PTA flags 326 cyber threats on dark web in a year, website defacement tops list

File photo: Faisal Mosque in Islamabad

The Pakistan Telecommunication Authority (PTA) has flagged 326 significant cyber threats in a year of dark-web monitoring, according to its Cyber Security Annual Report 2025-26. The monitoring was carried out by the PTA’s National Telecommunications Security Operations Centre (nTSOC) between July 2025 and June 2026, drawing on dark-web forums, illegal online marketplaces, commercial threat-intelligence platforms and open-source channels.

What topped the list

Website defacement was by far the biggest category — 174 incidents, or 53 percent of everything recorded. Next came data leaks, with 87 cases (27 percent) exposing credentials and organisational information that criminals could exploit. Distributed denial-of-service (DDoS) threats accounted for 41 cases (13 percent), pointing to repeated attempts to knock online systems offline. The remaining 24 cases, seven percent, involved sensitive information being advertised or offered for sale. The report also notes a sharp jump in September 2025 in the number of URLs and social media accounts flagged for blocking, followed by a decline in the months after — with social media blocking indicators staying higher than those for URLs and apps for much of the period.

What ordinary users are facing

The findings landed on the same day as the closing ceremony of Cybersecurity Awareness Week in Islamabad, where PTA Chairman Major General (retd) Hafeez ur Rehman warned that Pakistan is under constant cyberattack. Thousands of fake videos are circulating, he said, and scarcely a citizen is spared fraudulent calls and one-time-password messages, while institutions keep receiving fake threats. The telecom sector itself, he conceded, is not completely secure. The Federal Investigation Agency is working on such cases, he added, while the PTA, NADRA and PEMRA are working to harden their own systems. His appeal to the public was blunt: do not forward unverified messages — they spread misinformation and put other people at risk.

What comes next

At the same ceremony, Federal Information Minister Attaullah Tarar announced that a formal, empowered National Cybersecurity and Social Media Awareness Council will be set up within one to two weeks. Under his proposal, the council would bring together federal ministries, all provincial governments, the PTA, the National Cyber Crime Investigation Agency (NCCIA), the Social Media Protection and Regulatory Authority (SMPRA) and the United Nations Development Programme (UNDP), with the PTA leading it. Tarar argued that awareness work cannot be confined to a single week of campaigning; it has to run 365 days a year. He also proposed making digital literacy a compulsory part of the curriculum at school, college and university level, setting up digital literacy cells in every public and private educational institution, and making AI labelling of artificially generated content mandatory through a legal and regulatory framework, so users can tell what was made by AI.