PTA records over 10,000 cyber alerts in annual report

Annual cybersecurity report details 534 malicious addresses blocked, 151 advisories issued and 35 telecom licensees subjected to regulatory validation audits ISLAMABAD: The Pakistan Telecommunication Authority (PTA) recorded more than 10,000 cybersecurity alerts, escalated approximately 1,500 for investigation and coordinated the blocking of 534 malicious internet addresses and domains, according to its Cyber Security Annual Report 2024-25. The report highlights growing cyber threats targeting Pakistan's telecommunications infrastructure, government institutions and other critical sectors, particularly during heightened regional tensions in April and May 2025. According to the PTA, its National Telecom Security Operations Centre (nTSOC) monitored threats, coordinated responses with telecom operators and issued 151 cybersecurity advisories covering software vulnerabilities, phishing campaigns, ransomware and other malicious activities. The authority said 534 malicious IP addresses and domains associated with cyberattacks were blocked through coordination with telecom operators and internet service providers. The monitoring system also identified hundreds of leaked credentials associated with public sector organisations, telecom users and enterprise infrastructure through surveillance of dark web activity. The report said Pakistan experienced a significant increase in cyber threats following the Pahalgam incident in April 2025. Between April and May, the nTSOC tracked more than 112 major cyber incident claims, 25 distributed denial-of-service (DDoS) attacks and 104 dark web threats directed against Pakistan. Telecom operators successfully mitigated approximately 25 DDoS attacks during the period, with incidents lasting between one and 60 minutes. A dedicated cybersecurity control room was established to coordinate responses among relevant government agencies, national cybersecurity institutions and telecom operators. The PTA also identified increasing use of artificial intelligence in cyberattacks, including voice-cloning fraud, AI-generated phishing messages and deepfake impersonations of government officials. The report warned that attackers were increasingly relying on stolen credentials, deceptive communications and legitimate system tools rather than conventional malicious software. Government institutions, telecom operators, universities and law enforcement agencies were among the sectors targeted by cybercriminals and advanced persistent threat groups. More than 30 academic websites were either defaced or infected with malicious web shells, while thousands of university credentials appeared on dark web marketplaces, according to the report. The PTA also identified attempts to exploit outdated telecommunications equipment, exposed administrative systems and reused passwords to gain unauthorised access to networks. On the regulatory side, the authority reported that 36 telecom licensees had been integrated with the nTSOC for cybersecurity monitoring and threat information sharing. During the reporting period, 50 telecom licensees underwent cybersecurity assessments by registered third-party audit firms, while 35 were subjected to regulatory validation audits conducted by the PTA. The regulator's assessment identified significant differences in compliance across cybersecurity controls. Compliance with cybersecurity incident management requirements stood at 93.3%, while cybersecurity continuity management and reporting requirements recorded compliance rates of 91.7% and 95.8%, respectively. However, malware protection recorded a compliance rate of only 61.1%, followed by critical telecom infrastructure management at 65.2%, monitoring at 71.9% and cybersecurity framework implementation at 76.6%. The findings indicate continuing weaknesses in technical safeguards despite stronger compliance with several administrative and reporting requirements. To address emerging threats, the PTA developed the Critical Telecom Data and Infrastructure Security Regulations 2025, revising the framework introduced in 2020. The updated framework expands cybersecurity requirements covering asset management, risk assessment, data privacy, cloud security, insider threats, business continuity and incident response. It also strengthens requirements for identity verification, access controls and coordination with the national telecom security monitoring system. The PTA said the revised framework was designed to align telecom cybersecurity requirements with international standards and Pakistan's National Cybersecurity Policy 2021. The authority also outlined plans to develop dedicated 5G security guidelines, strengthen protection against DDoS attacks and introduce additional cybersecurity audit automation. Under its proposed 2025-26 audit programme, the regulator plans to require full audit coverage of Category I and Category II telecom licensees and conduct validation audits of selected operators in other categories. The report emphasised that improving cybersecurity monitoring, strengthening technical controls and expanding cooperation between regulators and telecom operators would be necessary to protect Pakistan's growing digital infrastructure.