PTA Records Over 10,000 Cybersecurity Alerts, Blocks 534 Malicious Internet Addresses

The Pakistan Telecommunication Authority (PTA) recorded more than 10,000 cybersecurity alerts during 2025-26. It escalated approximately 1,500 alerts for investigation and coordinated the blocking of 534 malicious IP addresses and internet domains.

The findings appear in the PTA’s Cyber Security Annual Report 2024-25. The report highlights growing threats against Pakistan’s telecommunications networks, government institutions and other critical sectors.

Regional tensions in April and May 2025 also coincided with a significant increase in cyber activity targeting Pakistan.

The PTA’s National Telecom Security Operations Centre (nTSOC) monitored threats and coordinated responses with telecom operators. It also issued 151 cybersecurity advisories covering software vulnerabilities, phishing campaigns, ransomware and other malicious activities.

Cyber Threats Increased During Regional Tensions

The PTA reported a sharp rise in cyber threats following the Pahalgam incident in April 2025.

Between April and May, the nTSOC tracked more than 112 major cyber incident claims. It also recorded 25 distributed denial-of-service (DDoS) attacks and 104 dark web threats directed against Pakistan.

Telecom operators successfully mitigated approximately 25 DDoS attacks during this period. Individual incidents lasted between one and 60 minutes.

To coordinate the response, authorities established a dedicated cybersecurity control room. It brought together relevant government agencies, national cybersecurity institutions and telecom operators.

The PTA also identified hundreds of leaked credentials linked to public sector organisations, telecom users and enterprise infrastructure. These credentials emerged through monitoring of dark web activity.

AI-Powered Attacks and Stolen Credentials Raise Risks

The report highlighted the growing use of artificial intelligence in cyberattacks. Emerging methods included voice-cloning fraud, AI-generated phishing messages and deepfake impersonations of government officials.

Attackers were also increasingly using stolen credentials and deceptive communications. The report noted that malicious actors were relying more on legitimate system tools instead of conventional malware.

Government institutions, telecom operators, universities and law enforcement agencies faced attacks from cybercriminals and advanced persistent threat groups.

More than 30 academic websites were defaced or infected with malicious web shells. Thousands of university credentials also appeared on dark web marketplaces.

The PTA further identified attempts to exploit outdated telecommunications equipment, exposed administrative systems and reused passwords. These weaknesses could provide unauthorised access to networks.

PTA Expands Telecom Cybersecurity Monitoring

The regulator reported progress in bringing telecom licensees into its national monitoring system.

A total of 36 telecom licensees had been integrated with the nTSOC for cybersecurity monitoring and threat information sharing.

During the reporting period, registered third-party audit firms assessed 50 telecom licensees. The PTA also conducted regulatory validation audits of 35 licensees.

These assessments highlighted differences in compliance across cybersecurity controls.

Cybersecurity incident management recorded a compliance rate of 93.3%. Continuity management reached 91.7%, while reporting requirements recorded 95.8%.

However, several technical controls showed weaker results.

Malware Protection and Infrastructure Security Remain Weak

Malware protection recorded the lowest compliance rate at 61.1%. Critical telecom infrastructure management followed at 65.2%.

Monitoring requirements achieved 71.9% compliance. Cybersecurity framework implementation recorded 76.6%.

<text color=”secondary” size=”sm”>PTA cybersecurity compliance assessment</text>

The findings point to continuing weaknesses in technical safeguards. This is despite stronger compliance with several administrative, incident-management and reporting requirements.

Updated Regulations Strengthen Telecom Security Framework

To address emerging threats, the PTA developed the Critical Telecom Data and Infrastructure Security Regulations 2025. The updated rules revise the framework introduced in 2020.

The new framework expands requirements for asset management, risk assessment, data privacy and cloud security. It also covers insider threats, business continuity and incident response.

Additional provisions strengthen identity verification and access controls. The regulations also reinforce coordination with the national telecom security monitoring system.

The PTA said the revised framework aims to align telecom cybersecurity requirements with international standards and Pakistan’s National Cybersecurity Policy 2021.

PTA Plans 5G Security Guidelines and Wider Audits

The authority also outlined further measures to strengthen the country’s digital infrastructure.

These include dedicated cybersecurity guidelines for 5G networks, stronger protection against DDoS attacks and greater automation of cybersecurity audits.

Under its proposed 2025-26 audit programme, the PTA plans full audit coverage of Category I and Category II telecom licensees. It also intends to conduct validation audits of selected operators in other categories.

Supermarket Cyber-Attacks Raise Concerns Over Security of Internet-Connected Devices

The report stressed the need for stronger cybersecurity monitoring and improved technical controls. It also called for closer cooperation between regulators and telecom operators.

As Pakistan’s digital infrastructure expands, these measures will play an important role in protecting telecommunications networks and other critical services from increasingly sophisticated cyber threats.