Banks, financial institutions: National CERT warns of rising AI-powered cyberattacks
ISLAMABAD: Pakistan’s National Cyber Emergency Response Team (National CERT) on Friday warned banks, financial institutions and operators of critical infrastructure against emerging artificial intelligence (AI)-enabled cyber threats, cautioning that automated bots and agentic tools could be used to manipulate banking information, disrupt digital services and compromise essential industrial operations.
In an advisory, National CERT said the growing use of AI, automated bots, botnets and agentic tools was enabling cybercriminals to accelerate reconnaissance, identify system vulnerabilities, conduct credential-based attacks and launch coordinated cyberattacks on a much larger scale.
The advisory, titled “Emerging AI-Enabled Cyber Threats Targeting Financial Institutions and OT/Critical Infrastructure,” said financial services and operational technology (OT) systems required particular attention because a successful breach could have serious financial, commercial and physical consequences.
READ ALSO: Pakistan govt entity hit by cyberattack last week, official says
National CERT cautioned that banks could face attacks targeting core banking systems, digital banking platforms, application programming interfaces (APIs), payment systems and customer-facing applications.
Potential attack scenarios include disruption of online banking services, automated credential attacks and manipulation of account balances displayed to customers, potentially triggering panic even when the underlying funds remain unchanged.
The advisory identified repeated authentication failures, unusual automated login attempts, credential stuffing, abnormal API requests, unauthorised application configuration changes and irregular transaction patterns as possible indicators of cyber intrusions.
It also warned that discrepancies between core banking records and customer-facing account balances, along with unauthorised access to payment systems, could indicate attempts to compromise financial infrastructure.
For the critical infrastructure sector, National CERT highlighted vulnerabilities arising from third-party service providers, connected Internet of Things (IoT) devices, industrial control systems and insecure remote access.
Oil and gas facilities, water utilities, power generation and distribution networks, manufacturing plants and transportation systems were identified as potential targets.
A successful compromise of operational technology could disrupt physical processes and essential public services, including industrial operations and utility supplies.
The advisory cited recent cyber incidents involving European supermarkets, where attacks on connected refrigeration and freezer systems demonstrated the potential physical and commercial consequences of compromising operational systems. However, it clarified that AI involvement in those incidents had not been confirmed.
National CERT has advised financial institutions to review the security of core banking systems, APIs, third-party integrations, payment gateways and digital banking applications.
It also recommended multi-factor authentication, protection against automated login attempts, privileged-access management and independent reconciliation of transactions to ensure the integrity of customer-facing information and underlying banking records.
For critical infrastructure operators, the advisory called for identifying internet-facing IoT and OT assets, reviewing the security of industrial control systems (ICS) and supervisory control and data acquisition (SCADA) environments, restricting direct internet exposure and securing third-party remote maintenance connections.
It further stressed the need for IT and OT network segmentation, continuous monitoring of access to operational systems, timely security updates and backup operating procedures for essential processes.
National CERT urged all organisations to assess their preparedness against bot-driven AI cyberattacks and strengthen incident response, business continuity and security monitoring arrangements.
Organisations were also advised to maintain security logs and report suspected cyber incidents through relevant national cybersecurity channels.
Copyright Business Recorder, 2026