PTA counts 326 dark web threat indicators in a year and warns 5G raises the stakes
The telecom regulator's annual cyber security report finds website defacement the most common threat, and says the 5G core, with its subscriber and location data, is the network element most worth attacking.
Website defacement made up more than half of the 326 threat indicators the Pakistan Telecommunication Authority picked up through dark web monitoring between July 2025 and June 2026. The count comes from the regulator's Cyber Security Annual Report 2025 to 26, which also sets out how the PTA sees the security risks of 5G.
What the monitoring found
The regulator's National Telecommunications Security Operations Centre, known as the nTSOC, watches dark web forums, illegal marketplaces, commercial threat intelligence platforms and open source intelligence, then correlates what it finds with other threat feeds. Website defacement was the largest category, with 174 indicators, or 53 percent. Data leaks followed with 87 (27 percent) and DDoS threats with 41 (13 percent). The remaining 24 (7 percent) were offers to sell or advertise sensitive information.
The report adds that URLs and social media accounts flagged for blocking rose sharply in September 2025 and fell in the months after. Social media blocking indicators stayed higher than those for URLs and apps for much of the year. The PTA warned that leaked login details and organisational data could expose individuals and businesses to further attacks.
The 5G section
The report lists the threats the regulator expects as 5G spreads: theft of subscriber data, real time location tracking, denial of service attacks and disruption of critical telecom infrastructure. It finds weaknesses across user devices, radio access networks, core network functions, APIs and cloud hosted services. On devices, the risks include insecure firmware, weak device validation, inadequate encryption and poor patching, which could allow unauthorised access and the spread of malware.
The 5G core is rated a high impact target because it holds subscriber records, location data, authentication, session management and routing information. The report also flags network slicing, where weak isolation or misconfiguration could leak data between services, and edge networks, where distributed and containerised workloads add risk through hypervisor escape and privilege escalation.
The PTA's response is its 5G Security Guidelines, issued in December 2025. They call for zero trust architecture, secure boot, firmware integrity checks and regular patching, and for AI driven anomaly detection on radio networks. For APIs they point to OAuth 2.0 authorisation and TLS 1.3 encryption.
To reduce the risk from IMSI catchers, devices that impersonate cell towers, operators are told to use the Subscription Concealed Identifier, which hides a subscriber's permanent identity over the air. The report says security has to be built into network design from the start rather than added after services go live.
