NCERT warns banks and utilities of AI-driven cyberattacks
Pakistan's National CERT has warned that AI and automated tools are being used for coordinated cyberattacks. Banks, financial institutions and critical infrastructure face increased risk, it said.
- NCERT issued the advisory on 5 November.
- Banks, oil and gas, water, power and transport systems are named as targets.
- Banks are advised to use multi-factor authentication and check customer-facing balances against internal records.
Pakistan's National Cyber Emergency Response Team (NCERT) has warned that artificial intelligence, automated bots and advanced digital tools are increasingly being used to launch coordinated cyberattacks. It said banks, financial institutions and critical infrastructure are at greater risk. Minute Mirror reported that the advisory was issued on 5 November.
According to the advisory, cybercriminals use AI-powered technologies to find weaknesses in systems, gather information about targets and carry out automated attacks using stolen login credentials. NCERT said these tools could raise the speed, scale and sophistication of cyber operations. The advisory applies to all sectors, but it said financial services and operational technology, especially critical infrastructure, need special attention.
For banks, the possible threats include disruption of digital banking services, automated attempts to get into customer accounts and manipulation of the balances shown to users. NCERT said such changes could cause confusion and panic among customers. It also pointed to risks to core banking systems, digital banking platforms, payment systems, APIs and customer applications.
On critical infrastructure, the advisory lists oil and gas facilities, water supply networks, electricity generation and distribution, manufacturing units and transport services. NCERT said a successful breach could interfere with physical operations and disrupt essential public services.
The advisory referred to recent cyber incidents in Europe that affected supermarket refrigeration and freezer systems. NCERT said AI's involvement in those incidents has not been confirmed.
NCERT listed warning signs to watch for: unusually frequent login attempts, repeated authentication failures, credential stuffing, abnormal API requests, changes to application configuration and unexpected transaction patterns. It said differences between core banking records and balances shown to customers could point to manipulation.
For banks, NCERT recommended multi-factor authentication, stronger safeguards against automated logins and regular checks of customer-facing information against internal records. For utilities and infrastructure operators, it advised restricting direct internet exposure, securing remote access, reviewing protection of connected devices and industrial control systems, and separating operational technology networks from conventional IT systems.
It also urged organisations to install security updates regularly, monitor access to operational networks, keep backup procedures and detailed incident records, and strengthen monitoring, emergency response and business continuity arrangements. It asked them to assess their preparedness for AI-assisted attacks.
Background
khabr.pk reported on 6 November that NCERT had issued an advisory on AI-driven cyber threats to banks and key infrastructure. On 26 October, khabr.pk reported a separate high-level NCERT alert on malware attacks through WhatsApp Web, WhatsApp Desktop and email.
Why it matters
Bank customers in Pakistan could be affected if attackers target digital banking services or the balances shown in their accounts. The advisory also names oil and gas, water supply, electricity and transport systems, which households and businesses rely on daily. Banks and infrastructure operators are the ones asked to act on its recommendations.
