The Pakistan Telecommunication Authority (PTA) has detected 326 significant cyber threat indicators through Dark Web monitoring in a year, including 174 website defacement incidents, 87 data leaks and 41 distributed denial-of-service (DDoS) threats, highlighting persistent vulnerabilities in Pakistan’s digital infrastructure.
According to the PTA’s Cyber Security Annual Report 2025-26, website defacement was the most frequently identified cyber threat, accounting for 53 percent of all indicators recorded by the National Telecommunications Security Operations Centre (nTSOC) between July 2025 and June 2026.
Data leaks accounted for 27 percent of the identified threats, while DDoS-related incidents represented 13 percent. Another 24 cases, or seven percent, involved the advertisement or sale of sensitive information through Dark Web forums and illegal online marketplaces.
The report highlighted the exposure of compromised credentials and organisational information through data leaks, warning of the potential exploitation of such information by cybercriminals.
Website defacement remained the dominant threat category, reflecting continued attempts to compromise online platforms. DDoS-related threats, meanwhile, underscored the risk of disruption to internet-facing systems and digital infrastructure.
The PTA said continuous Dark Web intelligence monitoring had strengthened its ability to identify emerging cyber threats, compromised digital assets and malicious activities that might remain undetected through conventional monitoring mechanisms.
The nTSOC monitors Dark Web forums, illegal marketplaces, commercial threat intelligence platforms and open-source intelligence channels to identify compromised digital assets, data leaks, website defacements and other malicious activities that could threaten the telecommunications sector and critical information infrastructure.
The intelligence gathered from these sources is correlated with information from other threat intelligence feeds to establish the context of threats, assess potential impacts and identify actionable findings for further investigation and response.
The report also highlighted trends in the blocking of URLs, applications and social media accounts during the reporting period from July 2025 to June 2026.
The monitoring data showed a sharp increase in the number of URLs and social media accounts flagged for blocking in September 2025, followed by a decline in subsequent months. Social media blocking indicators remained comparatively higher than URL and application blocking figures during much of the period.
The PTA said continuous monitoring of deep and Dark Web sources, commercial threat intelligence platforms and open-source intelligence channels enhanced threat visibility and helped identify malicious infrastructure, emerging threats and indicators of compromise from diverse sources.
The findings underline the growing importance of proactive cyber threat intelligence in identifying vulnerabilities, limiting the exposure of sensitive information and strengthening the resilience of Pakistan’s telecommunications networks and digital services.
