By Staff Reporter
ISLAMABAD: Pakistan’s national cyber emergency agency has warned banks and the operators of power, water and oil and gas facilities that hackers are increasingly using artificial intelligence and automated bots to launch coordinated attacks.
In an advisory issued on Thursday, the National Cyber Emergency Response Team (NCERT) said it had recently observed a rise in the use of “AI, automated bots, botnets and agentic tools to automate reconnaissance, identify vulnerabilities, conduct credential-based attacks and launch coordinated cyberattacks”.
“These capabilities may help threat actors and sophisticated cybercriminal groups to broaden the scale, speed and sophistication of their operations,” the agency said.
The advisory, numbered NCA-26.051126 and titled Emerging AI-Enabled Cyber Threats Targeting Financial Institutions and OT/Critical Infrastructure, is addressed to all sectors and organisations. NCERT said two areas “require particular attention”: financial services, and operational technology (OT) and critical infrastructure.
Panic over balances
Banks, it said, could face attacks on core banking systems, digital banking platforms, payment systems, application programming interfaces (APIs) and customer-facing applications. The scenarios it listed included the disruption of online services, automated credential attacks and the manipulation of displayed account balances.
That last risk carries a particular danger. The advisory said altered balances could trigger panic among customers even where the underlying funds remained unchanged.
For critical infrastructure, NCERT pointed to a different kind of exposure. “Third-party service providers, connected IoT (internet of things) devices, vulnerabilities in industrial control systems and insecure remote access may expose oil and gas facilities, water utilities, power generation and distribution networks, manufacturing, transportation and other essential services,” it said.
“A compromise could disrupt physical processes and critical services,” it added.
The agency cited recent cyberattacks in Europe that targeted refrigeration and freezer systems at supermarkets as an example of the “physical and commercial consequences of attacks against connected operational systems”. It stressed, however, that AI involvement in those incidents “has not been confirmed yet”.
Warning signs
The advisory lists anomalies that may point to an attack on a financial institution. They include frequent automated login attempts, repeated authentication failures, credential stuffing and unusual API requests. It also cites changes to application configurations, abnormal transaction patterns and unauthorised access to payment systems. A difference between core banking records and the balances shown to customers is another indicator.
In critical infrastructure, NCERT said changes to refinery, pipeline, grid, power generation or distribution parameters could signal an intrusion. So could access to industrial control and SCADA environments, or unexpected changes to pressure, temperature, cooling or heating settings. Unexpected remote access sessions and changes to IoT or OT device configurations were also flagged.
What institutions are being told to do
NCERT recommended that financial institutions check the security of their core banking systems, APIs, third-party integrations, payment gateways and digital banking applications. It urged them to use multi-factor authentication, protection against automated login attempts and privileged-access management.
It also called for integrity checks between consumer-facing applications and core banking records, along with independent transaction reconciliation. Banks should monitor for bot-driven attempts, potential service disruption and abnormal API activity, it said.
For utility providers, the agency advised limiting direct internet exposure and remote access, including third-party maintenance connections. It also advised identifying internet-facing IoT and OT assets and checking the security of industrial control systems.
“Enforce OT/IT network segmentation and continuously monitor access to operational systems,” the advisory said. “Keep applying security updates and maintain backup operating procedures for essential processes.”
All organisations were urged to assess their preparedness against bot-driven AI cyberattacks, maintain security logs and strengthen incident response, business continuity and security monitoring. They were also told to report suspected incidents through the relevant national cyber security channel.
Growing concern over AI risk
Pakistan’s first national CERT was announced in March 2024, and it has since issued a series of advisories. A separate recent advisory warned organisations against the uncontrolled use of generative AI tools, including unapproved public chatbots and coding assistants, and called for mandatory human review of AI-generated code.
The financial sector’s exposure to AI-enabled threats has already drawn attention at ministerial level. In May, Finance Minister Muhammad Aurangzeb chaired a virtual meeting with bank chief executives and chief information security officers, who were briefed on the growing use of AI to identify vulnerabilities, develop exploits and carry out complex, multi-stage attacks at speed. He called for closer coordination between regulators, banks and technical teams, and asked the State Bank of Pakistan and the Pakistan Banks’ Association to review existing frameworks and identify gaps.
Copyright © 2021 Independent Pakistan | All rights reserved
