Pakistan’s cyber emergency team warns banks and utilities of AI-driven cyberattacks
Islamabad: Pakistan’s National Cyber Emergency Response Team (NCERT) has warned that banks and essential services such as power, water and gas face a growing threat from cyberattacks powered by artificial intelligence and automated bots. In an advisory dated November 5, the team said attackers are increasingly using AI, automated bots, botnets and agentic tools to automate reconnaissance, find vulnerabilities, steal credentials and launch coordinated attacks.
What banks are up against
The advisory says core banking systems, digital banking platforms, payment systems and customer-facing applications are all in the firing line. Possible scenarios include online services going down, automated credential attacks and the manipulation of account balances shown to customers. “These capabilities may help threat actors and sophisticated cybercriminal groups to broaden the scale, speed and sophistication of their operations,” NCERT warned.
Power, water and gas also exposed
On the infrastructure side, third-party service providers, connected IoT devices, vulnerabilities in industrial control systems and insecure remote access could expose oil and gas facilities, water utilities, power generation and distribution networks, manufacturing and transport. “A compromise could disrupt physical processes and critical services,” the advisory said. It pointed to recent incidents in Europe, where cyberattacks targeted supermarket refrigerators and freezers, as a warning of the physical and commercial damage such attacks can cause — though AI involvement in those incidents has not been confirmed.
Warning signs and what to do
For banks, the warning signs include frequent automated login attempts, repeated authentication failures, unusual API requests, abnormal transaction patterns, a mismatch between core banking records and the balance displayed to customers, and unauthorised payment access. For critical infrastructure, watch for sudden changes to refinery, pipeline, grid or power-generation parameters, unexpected shifts in pressure, temperature or cooling and heating controls, surprise remote-access sessions and changes to IoT or OT device settings.
NCERT has told financial institutions to review the security of their core banking systems, APIs, third-party integrations, payment gateways and digital banking apps, to use multi-factor authentication, to guard against automated login attempts and to run integrity checks between customer-facing apps and core banking records. Utility providers are advised to limit direct internet exposure and remote access, check the security of IoT assets and industrial control systems, enforce OT/IT network segmentation and keep backup operating procedures ready for essential processes. All organisations have been urged to test their readiness against bot-driven AI attacks, keep incident logs and strengthen incident response, business continuity and security monitoring.
