National Cyber Emergency Response Team (NCERT) has warned organisations across Pakistan about the growing use of artificial intelligence (AI), automated bots, botnets and agentic tools to conduct coordinated cyberattacks, with financial services and critical infrastructure facing particular risks. In an advisory dated November 5, the team highlighted an increase in the use of automated technologies to conduct reconnaissance, identify system vulnerabilities, launch credential-based attacks and coordinate malicious cyber activities. According to NCERT, these capabilities could allow threat actors and sophisticated cybercriminal groups to expand the scale, speed and complexity of their operations. The advisory applies to organisations across all sectors, although financial institutions and operators of operational technology (OT) and critical infrastructure have been urged to pay particular attention to the identified threats. The growing use of AI-enabled tools in cyber operations could make it easier for attackers to automate activities that previously required greater manual effort, potentially increasing the frequency of attempts against exposed systems and digital services. NCERT’s warning highlights the importance of strengthening cybersecurity controls, monitoring unusual activity and reviewing existing security arrangements as organisations continue to rely on interconnected digital platforms and automated systems.
Financial institutions have been advised to remain alert to potential attacks targeting core banking systems, digital banking platforms, payment infrastructure and customer-facing applications. NCERT identified several possible attack scenarios, including disruption of online banking services, automated attempts to obtain account credentials and manipulation of account balances displayed to customers. Such activity could affect the availability and reliability of financial services and create discrepancies between information presented through customer-facing platforms and records maintained by core banking systems. The advisory also identifies unusual authentication activity and suspicious application programming interface (API) requests as possible indicators of malicious activity. For critical infrastructure, NCERT highlighted risks associated with third-party service providers, connected Internet of Things (IoT) devices, vulnerabilities in industrial control systems and insecure remote access arrangements. These weaknesses could expose essential facilities and services across the oil and gas sector, water utilities, electricity generation and distribution, manufacturing and transportation. A compromise involving operational systems could affect physical processes and disrupt services that communities and businesses depend on. NCERT also referred to cyber incidents involving supermarket refrigeration systems in Europe, where attacks targeting connected refrigerators and freezers demonstrated the potential physical and commercial consequences of weaknesses in operational technology. However, the team clarified that AI involvement in those particular incidents had not been confirmed.
The advisory outlined several indicators that organisations should monitor when assessing potential cyber threats. For financial institutions, these include frequent automated login attempts, repeated authentication failures, unusual API requests and abnormal transaction patterns. Differences between core banking records and account balances displayed to customers, as well as unauthorised access to payment systems, may also indicate suspicious activity requiring investigation. In operational technology environments, unexpected changes to refinery, pipeline, electricity grid, power generation or distribution parameters could point towards an attempt to interfere with industrial processes. NCERT also identified unusual adjustments to pressure, temperature, cooling and heating controls as potential warning signs. Unexpected remote access sessions and unauthorised changes to IoT or OT device configurations should similarly receive attention, particularly where these systems support essential services. The advisory encourages organisations to monitor these indicators as part of their routine security operations and investigate unusual behaviour before it develops into a wider disruption. Maintaining visibility across digital and operational environments is important because suspicious activity may involve connected devices, third-party services or remote access points rather than only conventional IT infrastructure. Organisations should also ensure that security monitoring covers the systems and interfaces through which critical business and operational functions are managed.
To reduce exposure to these threats, NCERT has recommended that financial institutions review the security of their core banking systems, APIs, third-party integrations, payment gateways and digital banking applications. Banks have also been advised to implement multi-factor authentication, strengthen protections against automated login attempts and conduct integrity checks between customer-facing applications and core banking records. Monitoring bot-driven activity, possible service disruptions and abnormal API requests is another recommended measure. For utility providers and organisations operating critical infrastructure, NCERT has urged them to minimise direct internet exposure, restrict remote access and review the security of connected IoT assets and industrial control systems. The advisory further recommends enforcing segmentation between operational technology and information technology networks, continuously monitoring access to operational systems, applying security updates and maintaining backup operating procedures for essential processes. Beyond these sector-specific measures, all organisations have been encouraged to assess their preparedness for AI-driven and bot-based cyberattacks, maintain incident logs and strengthen incident response arrangements. Business continuity planning and security monitoring should also form part of these preparations to help organisations identify suspicious activity, respond to incidents and maintain essential operations during disruptions. Through the advisory, NCERT has emphasised the need for organisations to review their security practices and improve resilience against increasingly automated cyber threats.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
