ISLAMABAD: The National Cyber Emergency Response Team (NCERT) has warned of an increased use of artificial intelligence (AI) and automated bots to carry out credential-based and coordinated cyberattacks, noting that critical infrastructure and financial services are at particular risk.
NCERT, in an advisory dated Nov 5, said an increase in “AI, automated bots, botnets and agentic tools to automate reconnaissance, identify vulnerabilities, conduct credential-based attacks and launch coordinated cyberattacks” has been observed recently.
“These capabilities may help threat actors and sophisticated cybercriminal groups to broaden the scale, speed and sophistication of their operations.”
“This advisory is relevant to all sectors/organizations. However, two sectors require particular attention,” it stressed, referring to financial services, along with operational technology (OT) and critical infrastructure.
It warned banks that they could face attacks targeting core banking systems, digital banking platforms, payment systems and customer-facing applications, with potential scenarios including the disruption of online services, automated credential attacks, and manipulation of displayed account balances.
In terms of critical infrastructure, NCERT warned: “Third-party service providers, connected IoT (internet of things) devices, vulnerabilities in industrial control systems and insecure remote access may expose oil and gas facilities, water utilities, power generation and distribution networks, manufacturing, transportation and other essential services.
“A compromise could disrupt physical processes and critical services,” it added.
NCERT cited recent incidents in Europe, where supermarket refrigerators and freezers were targeted in cyberattacks, as examples of the “physical and commercial consequences of attacks against connected operational systems”.
“However, AI involvement in said incidents has not been confirmed yet,” it added.
The advisory listed anomalies which may indicate a potential cyberattack targeting financial institutions, such as frequent automated login attempts, repeated authentication failures, and unusual application programming interface (API) requests.
Abnormal transaction patterns, differences between core banking records and the displayed account balance, and unauthorised payment access were other indicators.
Published in Dawn, November 7th, 2026
