Pakistan’s telecom regulator logged 326 significant cyber threat indicators on the dark web between July 2025 and June 2026, and more than half of them were website defacements. The numbers appear in the regulator’s annual cyber security report for 2025-26.
The tracking is run by PTA’s National Telecommunications Security Operations Centre (nTSOC). Its analysts read underground forums and marketplaces, paid threat-intelligence services and public sources, then cross-check what it finds against other threat feeds to judge impact and pick what to chase. PTA says this catches compromised assets and malicious activity that ordinary monitoring misses.
174 defacements, 87 leaks
The report breaks the 326 indicators into four groups:
| Type of threat | Cases | Share |
|---|---|---|
| Website defacement | 174 | 53% |
| Data leaks | 87 | 27% |
| DDoS threats | 41 | 13% |
| Sale or advertising of sensitive information | 24 | 7% |
PTA says defacements show a steady effort to break into online platforms, while the leaks matter because exposed credentials can be reused by criminals. DDoS threats, in its words, endanger systems that face the internet. The 24 sale listings were found on dark web forums and illegal marketplaces.
The report also charts requests to block URLs and social media accounts from July 2025 to June 2026. Those requests peaked in September 2025 and then dropped; accounts on social platforms made up the bigger share for most months.
A separate warning about 5G
The same report looks ahead to Pakistan’s 5G rollout. PTA lists subscriber data theft, real-time location tracking and denial-of-service attacks among the risks, and says weak spots exist across devices, the radio network, core functions, APIs and cloud-hosted systems. It singles out the 5G core, which holds subscriber records and session data, as a prime target, and notes that edge networks built on distributed, containerised workloads carry extra risk.
To counter this, PTA has issued 5G Security Guidelines that favour prevention over repair. Operators are expected to adopt zero-trust architectures, secure boot and AI-driven anomaly detection, and to use concealed subscriber identifiers so permanent credentials can’t be picked up over the air. We covered a cybersecurity session at Zong with PTA and PKCERT earlier this week.
We could not open the full report on PTA’s website at the time of writing, so the figures above are as reported from it. We’ll update the post if the document is published in full.
