The Pakistan Telecommunication Authority’s PTA cyber security work has recorded 326 significant threat indicators through dark web monitoring over a year, including 174 website defacements, 87 data leaks and 41 distributed denial-of-service (DDoS) threats—attacks that flood online systems to knock them offline.
Those figures appear in the PTA’s Cyber Security Annual Report 2025-26. They cover activity tracked by the National Telecommunications Security Operations Centre (nTSOC)—the PTA unit that watches telecom and related digital risks—from July 2025 to June 2026. The PTA said the pattern points to ongoing weaknesses in Pakistan’s digital infrastructure.
What the numbers show
Website defacement—when attackers alter a site’s public pages without permission—was the single largest category. It accounted for 53 percent of all indicators nTSOC recorded in the period. Data leaks made up 27 percent, and DDoS-related cases 13 percent.
Separately, 24 cases, or seven percent, involved sensitive information being advertised or sold on dark web forums and illegal online marketplaces. The report warned that leaked credentials and organisational details can be reused by cybercriminals.
How the PTA watches the dark web
The PTA said continuous dark web intelligence monitoring has improved its ability to spot emerging threats, compromised digital assets and malicious activity that ordinary monitoring might miss.
nTSOC watches dark web forums, illegal marketplaces, commercial threat-intelligence platforms and open-source channels. Findings are matched against other threat feeds so staff can judge context, possible impact and what needs further investigation or response. The PTA also said watching deep and dark web sources alongside commercial and open feeds helped surface malicious infrastructure and indicators of compromise from many places.
Blocking trends in 2025-26
The same reporting period showed shifts in how many URLs, applications and social media accounts were flagged for blocking. Monitoring data pointed to a sharp rise in URLs and social media accounts marked for blocking in September 2025, then a fall in later months. Social media blocking indicators stayed higher than URL and application figures for much of the year.
Timeline: what has happened so far
- July 2025–June 2026: nTSOC records cyber threat indicators covered in the PTA Cyber Security Annual Report 2025-26.
- July 2025–June 2026: 326 significant indicators logged via dark web monitoring, including 174 defacements, 87 data leaks and 41 DDoS threats.
- September 2025: Sharp increase in URLs and social media accounts flagged for blocking.
- After September 2025: Blocking flags decline in subsequent months, while social media indicators remain comparatively higher than URL and app figures.
Aasan alfaaz mein
PTA ne dark web check karke aik saal mein 326 cyber threats pakre hain. In mein 174 website defacement the, yani sites ko bina ijazat change karna. Data leaks aur DDoS jaise hamle bhi mile. Aam logon ke liye matlab yeh hai ke passwords aur websites ki security zyada zaroori hai.
