Banks, utilities warned of AI-driven cyberattacks

Pakistan’s National Cyber Emergency Response Team (NCERT) has issued a cybersecurity warning over the growing use of artificial intelligence (AI), automated bots and advanced digital tools to launch coordinated cyberattacks, placing banks, financial institutions and critical infrastructure at increased risk.

In an advisory issued on November 5, NCERT said cybercriminals were increasingly using AI-powered technologies to identify system weaknesses, gather information about potential targets and carry out automated attacks using stolen login credentials.

The team warned that these technologies could significantly increase the speed, scale and sophistication of cyber operations, allowing criminal groups to target multiple organisations and systems more efficiently.

Although the advisory applies to all sectors, NCERT identified financial services and operational technology (OT), particularly critical infrastructure, as areas requiring special attention.

Banks could face attacks targeting core banking systems, online banking platforms, payment networks and customer-facing applications. Potential threats include disruption of digital banking services, automated attempts to access customer accounts and manipulation of account balances displayed to users.

The advisory also highlighted risks to essential infrastructure, including oil and gas facilities, water supply networks, electricity generation and distribution systems, manufacturing units and transportation services.

NCERT warned that vulnerabilities in industrial control systems, connected Internet of Things (IoT) devices, third-party service providers and poorly secured remote access systems could provide cybercriminals with entry points into critical networks.

A successful breach could interfere with physical operations and disrupt essential public services.

The team also referred to recent cyber incidents in Europe involving supermarket refrigeration and freezer systems, highlighting how attacks on connected operational technology could have physical and commercial consequences. However, it clarified that the involvement of AI in those particular incidents had not been confirmed.

NCERT identified several suspicious activities that financial institutions should monitor to detect potential cyber intrusions.

These include unusually frequent login attempts, repeated authentication failures, abnormal application programming interface (API) requests and unexpected transaction patterns.

Discrepancies between core banking records and account balances displayed to customers could also indicate possible manipulation. Unauthorised access to payment systems was another potential warning sign.

For critical infrastructure operators, unexpected changes in refinery operations, pipeline settings, electricity grids and power distribution parameters could signal a security breach.

Unusual adjustments to pressure, temperature, heating, cooling and other industrial control settings may also indicate unauthorised access. The advisory further highlighted unexpected remote access sessions and unexplained changes to IoT and operational technology configurations.

To reduce the risk of cyberattacks, NCERT has advised financial institutions to review the security of their core banking systems, digital applications, payment gateways, APIs and third-party integrations.

It recommended introducing multi-factor authentication and stronger safeguards against automated login attempts. Banks were also urged to regularly verify the accuracy of information displayed on customer-facing platforms against their internal banking records.

The advisory called for continuous monitoring of suspicious bot activity, unusual API requests and attempts to disrupt online services.

For utility companies and other critical infrastructure operators, NCERT recommended restricting direct internet exposure, securing remote access and regularly reviewing the protection of connected devices and industrial control systems.

It also stressed the importance of separating operational technology networks from conventional information technology systems to prevent security breaches from spreading between them.

Organisations were advised to install security updates regularly, monitor access to operational networks and maintain backup procedures to ensure essential services can continue during cyber incidents.

NCERT further urged public and private sector organisations to assess their preparedness for AI-assisted cyberattacks, maintain detailed records of security incidents and strengthen monitoring, emergency response and business continuity arrangements.