The Pakistan Telecommunication Authority (PTA) reported detecting 326 notable cyber threat indicators through Dark Web monitoring over the past year, among them 174 website defacement cases, 87 data leaks and 41 DDoS threats, underscoring ongoing vulnerabilities in the nation's digital infrastructure.
According to the PTA's Cyber Security Annual Report 2025-26, website defacement was the most common threat, making up 53 percent of all indicators logged by the National Telecommunications Security Operations Centre (nTSOC) from July 2025 to June 2026.
Data leaks represented 27 percent of the threats, while DDoS-related incidents accounted for 13 percent. An additional 24 cases, or seven percent, involved the advertisement or sale of sensitive data on Dark Web forums and illegal marketplaces.
The report warned that compromised credentials and organisational information exposed through data leaks could be exploited by cybercriminals.
Defacement remained the leading threat category, indicating continued attempts to hijack online platforms. DDoS threats highlighted the risk of service disruption to internet-facing systems and digital infrastructure.
PTA said ongoing Dark Web intelligence monitoring has improved its capacity to spot emerging cyber threats, compromised assets and malicious activity that might evade traditional monitoring methods.
The nTSOC tracks Dark Web forums, illegal marketplaces, commercial threat intelligence platforms and open-source channels to locate compromised assets, data leaks, website defacements and other malicious actions that could jeopardise the telecommunications sector and critical information infrastructure.
Information gathered from these sources is cross-referenced with other threat feeds to provide context, assess impact and produce actionable findings for further investigation and response.
The report also noted trends in blocking URLs, applications and social media accounts during the July 2025-June 2026 period.
Monitoring data showed a sharp rise in URLs and social media accounts flagged for blocking in September 2025, followed by a decline in later months. Social media blocking indicators stayed higher than URL and application blocking for much of the timeframe.
PTA emphasized that continuous monitoring of deep and Dark Web sources, commercial threat intelligence platforms and open-source channels enhances threat visibility and helps identify malicious infrastructure, emerging threats and compromise indicators from varied sources.
The findings highlight the increasing importance of proactive cyber threat intelligence in spotting vulnerabilities, limiting exposure of sensitive data and bolstering the resilience of Pakistan's telecommunications networks and digital services.
