ISLAMABAD: The Pakistan Telecommunication Authority (PTA) identified 326 significant cyber threat indicators through Dark Web monitoring between July 2025 and June 2026, according to its Cyber Security Annual Report 2025–26.
The report listed website defacement as the most frequently detected threat, with 174 incidents, followed by 87 data leaks and 41 distributed denial-of-service (DDoS) threats.
Website defacement accounts for 53% of threats
According to the report, website defacement accounted for 53% of the indicators recorded by the National Telecommunications Security Operations Centre (nTSOC). Data leaks represented 27%, while DDoS-related threats made up 13%.
The remaining 24 cases, or 7%, involved advertisements or sales of sensitive information through Dark Web forums and illegal online marketplaces.
The PTA warned that cybercriminals could exploit compromised credentials and organisational information exposed through data leaks. It said the high number of website defacement incidents reflected continued attempts to compromise online platforms, while DDoS threats highlighted the risk of disruptions to internet-facing systems and digital infrastructure.
Dark Web monitoring strengthens threat detection
The PTA said continuous Dark Web intelligence monitoring had improved its ability to identify emerging threats, compromised digital assets and malicious activities that conventional monitoring might miss.
The nTSOC monitors Dark Web forums, illegal marketplaces, commercial threat intelligence platforms and open-source intelligence channels. It correlates information from these sources with other threat intelligence feeds to assess potential risks and identify findings that require further investigation.
PTA tracks online content blocking
The report also examined the blocking of URLs, applications and social media accounts during the reporting period.
Monitoring data showed a sharp rise in the number of URLs and social media accounts flagged for blocking in September 2025, followed by a decline in subsequent months. Social media blocking indicators remained comparatively higher than URL and application figures for much of the period.
The PTA said continued monitoring of deep and Dark Web sources, alongside other intelligence channels, improved visibility into cyber threats and helped identify malicious infrastructure and indicators of compromise.
The findings highlight the importance of proactive cyber threat intelligence in reducing exposure to sensitive information and strengthening the resilience of Pakistan’s telecommunications networks and digital services.
