Pakistan’s banks, power grids and water utilities face a growing threat from cyberattacks powered by artificial intelligence, the National Cyber Emergency Response Team has warned in a new advisory.
The advisory, issued by NCERT, which works under the Cabinet Division, says artificial intelligence, automated bots, botnets and so-called agentic tools are making attacks faster, larger and more sophisticated.
Banks are named as a prime target. Their core systems, digital banking platforms, application programming interfaces, payment systems and customer-facing apps could all come under attack. Such attacks could disrupt online services and alter the balances customers see on screen, causing confusion and panic.
The warning extends well beyond banking. Oil and gas installations, refineries, pipelines, water utilities, electricity generation and distribution networks, manufacturing plants and transport systems are all listed as potential targets. Risks are also flagged from third-party service providers, connected internet-of-things devices, industrial control systems and insecure remote access.
The advisory cites refrigeration and freezer failures at European supermarkets as an example of how attacks on connected operational systems can have physical and commercial effects. It makes clear, however, that the involvement of artificial intelligence in those particular incidents has not been confirmed.
Financial institutions have been advised to watch closely for automated login attempts, repeated authentication failures, unusual requests to their programming interfaces, changes in application settings and abnormal transaction patterns. Banks should also check core banking records against the balances shown to customers, and run security reviews of their core systems, interfaces and payment gateways.
Energy and industrial operators have been told to monitor unusual changes in refinery operations, pipeline systems, electricity grids and other operating parameters. All organisations are advised to map their internet-connected devices, restrict direct internet access and third-party maintenance links, separate operational technology from information technology networks, install security updates regularly, and keep incident-response and business-continuity plans ready. The advisory reports no attack or breach in Pakistan; it is a warning to prepare.
