National Cyber Emergency Team Warns Banks of AI-Driven Cyberattacks on Critical Infrastructure

Islamabad: The National Cyber Emergency Response Team (NCERT), which operates under the Cabinet Division, has warned that the speed, scale and complexity of cyberattacks are increasing through artificial intelligence, automated bots, botnets and agentic tools. The warning was contained in an advisory issued on Friday.

According to the advisory, banks’ core banking systems, digital banking platforms, APIs, payment systems and customer applications could be targeted. Attackers may alter the account balances visible to customers without changing the underlying records, which could cause confusion and alarm among account holders.

Oil and gas installations, refineries, pipelines, water utilities, electricity generation and transmission networks, and industrial and transport systems are also at risk. Third-party service providers, internet-connected devices, weaknesses in industrial control systems and insecure remote access add to these risks.

The advisory cited attacks on refrigeration systems in European supermarkets as an example, but noted that the use of artificial intelligence in those incidents had not been confirmed.

Financial institutions have been directed to monitor automated login attempts, repeated failed authentication, unusual API requests, configuration changes and suspicious transactions. The advisory also recommends monitoring discrepancies between core banking records and customer balances, carrying out security reviews of APIs and payment gateways, and conducting independent audits of transactions.

Operators of critical installations have been asked to identify internet-connected IoT and operational technology assets, restrict direct internet access and external maintenance connections to them, keep OT and IT networks separate, and maintain continuous monitoring.

Organisations have also been instructed to install security updates regularly, maintain alternative procedures, strengthen incident response and business continuity arrangements, preserve security logs, and report suspicious activity to the relevant authorities.