National CERT Warns of AI-Powered Cyberattacks Targeting Pakistani Banks and Critical Infrastructure

Pakistan’s National Cyber Emergency Response Team (National CERT) has issued a warning about the growing threat of artificial intelligence (AI)-powered cyberattacks targeting banks, financial institutions and critical national infrastructure.

According to the advisory, cybercriminals are increasingly using AI tools, automated bots, botnets and agentic systems to identify security weaknesses, steal login credentials and coordinate cyberattacks. These technologies could make attacks faster, more sophisticated and easier to scale.

The warning highlights serious risks for Pakistan’s financial sector, particularly core banking systems, digital banking platforms, payment services and customer-facing applications. It also identifies essential services such as electricity, water, oil and gas, manufacturing and transportation as potential targets.

AI-Powered Attacks Could Put Banking Systems at Risk

National CERT has warned that financial institutions could face cyberattacks designed to disrupt online banking services, compromise customer accounts and manipulate information displayed through banking applications.

One particularly concerning scenario involves attackers changing the account balances shown to customers. Even if the actual funds recorded in a bank's core systems remain unchanged, manipulated account information could create confusion, trigger panic and damage public confidence in digital banking.

Cybercriminals may also use automated tools to identify weaknesses in banking networks, repeatedly attempt account logins and exploit vulnerable systems.

Banks have therefore been advised to monitor suspicious login activity, unusual transactions, repeated authentication failures and abnormal requests to application programming interfaces (APIs).

Critical Infrastructure Also Faces Growing Cyber Risks

The advisory extends beyond banks and financial services. National CERT has identified several critical sectors that could be exposed to cyberattacks, including:

• Oil and gas facilities, refineries and pipelines.

• Electricity generation and distribution networks.

• Water supply and utility systems.

• Manufacturing and industrial facilities.

• Transportation and other essential services.

Many of these sectors depend on connected devices and automated operational technology (OT) systems. Vulnerabilities in Internet of Things (IoT) devices, industrial control systems and third-party service connections could give attackers an opportunity to access sensitive networks.

A successful intrusion could affect industrial operations, interrupt essential services or interfere with physical processes.

Warning Signs Banks and Financial Institutions Should Monitor

National CERT has outlined several indicators that could help financial institutions identify suspicious activity before it causes serious damage.

These warning signs include:

• A sudden increase in automated login attempts.

• Repeated authentication failures and credential-stuffing attempts.

• Unusual API requests or unauthorised application configuration changes.

• Unexpected financial transactions or irregular account activity.

• Differences between core banking records and balances displayed to customers.

• Unauthorised access to payment systems.

Banks should also pay attention to suspicious activity involving third-party integrations, payment gateways and digital banking applications.

The agency recommends strengthening authentication systems, monitoring automated attacks and introducing independent transaction checks to ensure that customer-facing information matches actual banking records.

National CERT Recommends Stronger Cybersecurity Measures

To reduce the risk of AI-enabled cyberattacks, National CERT has recommended several security improvements for banks and financial institutions.

Key recommendations include:

1. Implement Multi-Factor Authentication: Banks should strengthen login security by requiring additional verification beyond passwords.

2. Protect Banking APIs: Financial institutions should review API security, payment gateways and third-party integrations to identify weaknesses.

3. Monitor Automated Login Attempts: Security teams should detect and respond to unusual login activity, repeated authentication failures and bot-driven attacks.

4. Verify Account Information: Banks should introduce integrity checks between core banking records and customer-facing applications to prevent unauthorised manipulation of displayed balances.

5. Improve Access Management: Organisations should strengthen privileged-access controls and regularly review who can access sensitive systems.

These measures can help financial institutions detect suspicious activity and reduce the potential impact of cyber intrusions.

Critical Infrastructure Operators Urged to Secure Connected Systems

National CERT has also advised organisations responsible for essential services to review their Internet of Things devices and operational technology environments.

Industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems are particularly important because they help monitor and control industrial processes.

The agency recommends identifying internet-connected IoT and OT assets, restricting unnecessary internet exposure and securing remote maintenance connections.

It also stresses the importance of separating IT networks from operational technology networks. This segmentation can help prevent an attacker who gains access to one network from easily reaching critical industrial systems.

Other recommended measures include:

• Regularly updating software and security systems.

• Monitoring access to industrial control environments.

• Restricting unnecessary remote connections.

• Securing third-party maintenance access.

• Maintaining backup operating procedures for essential services.

These precautions are particularly important for electricity networks, water utilities, oil and gas facilities and manufacturing operations.

European Supermarket Cyberattacks Highlight Risks to Physical Operations

National CERT also referred to recent cyber incidents involving refrigeration and freezer systems at European supermarkets.

These incidents demonstrate how cyberattacks against connected operational systems can create physical and commercial consequences, potentially affecting business operations and essential equipment.

However, the advisory specifically clarifies that AI involvement in those European incidents has not been confirmed. The examples were included to highlight the broader risks associated with attacks on connected industrial and operational systems.

Organisations Urged to Prepare for AI-Driven Cyber Threats

National CERT has called on organisations across all sectors to improve their cybersecurity readiness as attackers increasingly adopt automated tools and AI-assisted techniques.

Businesses and government organisations should strengthen their incident response arrangements, improve security monitoring and maintain detailed security logs.

The advisory also recommends reviewing business continuity plans to ensure that essential operations can continue if a cyberattack disrupts normal services.

Organisations should be prepared to identify suspicious activity, respond quickly to security incidents and report suspected cyberattacks through the relevant national cybersecurity channels.

Final Thoughts

Pakistan's National CERT warning highlights how artificial intelligence is changing the cybersecurity landscape. AI-powered bots, automated tools and agentic systems could help cybercriminals identify vulnerabilities, target banking systems and disrupt critical infrastructure more efficiently.

For Pakistan, the risks extend beyond financial losses. A successful attack against electricity networks, water utilities, oil and gas facilities or industrial control systems could affect essential services and business operations.

Banks, government departments and private organisations should therefore review their existing security arrangements and take the recommended precautions seriously.

Although the advisory highlights potential threats rather than confirming a nationwide wave of AI-powered attacks, it sends an important message: organisations must strengthen their cybersecurity before vulnerabilities are exploited.