PTA Flags 10,000+ Cyber Alerts and Blocks 534 Malicious Addresses

PTA Flags 10,000+ Cybersecurity Alerts, Blocks 534 Malicious Addresses

ISLAMABAD: The Pakistan Telecommunication Authority (PTA) recorded more than 10,000 cybersecurity alerts, referred approximately 1,500 cases for investigation and coordinated the blocking of 534 malicious IP addresses and domains during 2024-25, according to its Cyber Security Annual Report 2024-25.

The report highlights growing cyber threats against Pakistan’s telecommunications networks, government institutions and other critical sectors, particularly during heightened regional tensions in April and May 2025.

The PTA said its National Telecom Security Operations Centre (nTSOC) monitored cyber threats, coordinated responses with telecom operators and issued 151 security advisories addressing software vulnerabilities, phishing campaigns, ransomware and other malicious activities.

Through coordination with telecom operators and internet service providers, the authority also helped block 534 IP addresses and domains linked to malicious activity.

The monitoring system further identified hundreds of leaked credentials associated with public sector organisations, telecom users and enterprise infrastructure through dark web surveillance.

Cyber Threats Increased During Regional Tensions

According to the report, cyber threats against Pakistan increased significantly following the Pahalgam incident in April 2025.

During April and May, the nTSOC tracked more than 112 major cyber incident claims, 25 distributed denial-of-service (DDoS) attacks and 104 dark web threats targeting Pakistan.

Telecom operators successfully mitigated approximately 25 DDoS attacks during this period. Individual incidents lasted between one and 60 minutes.

To improve coordination, a dedicated cybersecurity control room was established to facilitate responses involving government agencies, national cybersecurity institutions and telecom operators.

The PTA also highlighted the growing use of artificial intelligence in cybercrime, including voice-cloning scams, AI-generated phishing messages and deepfake impersonations of government officials.

The report warned that attackers were increasingly exploiting stolen credentials, deceptive communications and legitimate system tools instead of relying solely on conventional malware.

Universities and Government Institutions Among Targets

Government organisations, telecommunications companies, universities and law enforcement agencies were among the targets of cybercriminals and advanced persistent threat groups.

More than 30 academic websites were reportedly defaced or infected with malicious web shells, while thousands of university credentials appeared on dark web marketplaces.

The PTA also identified attempts to exploit outdated telecommunications equipment, exposed administrative systems and reused passwords to gain unauthorised access to networks.

Cybersecurity Compliance Shows Mixed Results

The regulator reported that 36 telecom licensees had been integrated with the nTSOC for cybersecurity monitoring and threat information sharing.

During the reporting period, registered third-party audit firms assessed 50 telecom licensees, while the PTA conducted regulatory validation audits of 35 operators.

The assessments revealed varying levels of compliance across different cybersecurity controls.

Cybersecurity incident management recorded a compliance rate of 93.3%, while continuity management stood at 91.7%. Reporting requirements achieved 95.8% compliance.

However, technical safeguards showed weaker results. Malware protection recorded compliance of 61.1%, followed by critical telecommunications infrastructure management at 65.2%, monitoring at 71.9% and cybersecurity framework implementation at 76.6%.

These findings point to continuing technical vulnerabilities despite stronger compliance in several administrative and reporting areas.

PTA Updates Telecom Security Regulations

To address emerging threats, the PTA developed the Critical Telecom Data and Infrastructure Security Regulations 2025, updating the framework introduced in 2020.

The revised regulations expand requirements covering asset management, risk assessment, data privacy, cloud security, insider threats, business continuity and incident response.

They also strengthen identity verification, access controls and coordination with the national telecom security monitoring system.

The PTA said the updated framework aims to align telecommunications security requirements with international standards and Pakistan’s National Cybersecurity Policy 2021.

New Security Measures Planned

The authority outlined plans to develop dedicated cybersecurity guidelines for 5G networks, improve protection against DDoS attacks and introduce further automation in cybersecurity audits.

Under its proposed 2025-26 audit programme, the PTA plans to ensure full audit coverage of Category I and Category II telecom licensees, alongside validation audits of selected operators in other categories.

The report stressed that stronger technical safeguards, improved threat monitoring and closer cooperation between regulators and telecom operators would be essential to protecting Pakistan’s expanding digital infrastructure.