AI-enabled cyberthreats could target financial services, critical infrastructure such as banks, utility providers

The National Cyber Emergency Response Team (NCERT) has warned of an increased use of artificial intelligence (AI), automated bots, botnets, and agentic tools to carry out credential-based and coordinated cyberattacks, noting that critical infrastructure and financial services are most at risk.

“These capabilities may help threat actors and sophisticated cyber criminal groups to broaden the scale, speed and sophistication of their operations,” NCERT said in its advisory dated Nov 5.

It warned banks that they could face attacks targeting core banking systems, digital banking platforms, payment systems and customer-facing applications, with potential scenarios including the disruption of online services, automated credential attacks, and manipulation of displayed account balances.

In terms of critical infrastructure, NCERT warned, “Third-party service providers, connected IoT (internet of things) devices, vulnerabilities in industrial control systems and insecure remote access may expose oil and gas facilities, water utilities, power generation and distribution networks, manufacturing, transportation and other essential services.

“A compromise could disrupt physical processes and critical services,” it added.

NCERT cited recent incidents in Europe, where supermarket refrigerators and freezers were targeted in cyberattacks, as examples of the “physical and commercial consequences of attacks against connected operational systems”.

“However, AI involvement in said incidents has not been confirmed yet,” it added.

Threat indicators

The advisory listed anomalies which may indicate a potential cyberattack targeting financial institutions, such as frequent automated login attempts, repeated authentication failures, and unusual application programming interface (API) requests.

Abnormal transaction patterns, a difference between core banking records and the displayed account balance, and unauthorised payment access were other indicators.

For critical infrastructure, NCERT said changes to refinery, pipeline, grid, power generation or distribution parameters could indicate an attack, as could unexpected changes to pressure, temperature, cooling or heading control settings.

Unexpected access sessions remotely or changes to IoT/operational technology (OT) device configurations could also point towards a cyberattack.

Recommendations

NCERT recommended that financial institutions check their core banking security, APIs, third-party integrations, payment gateways and digital banking applications.

It further urged them to use multi-factor authentication and protection against automated login attempts, while enforcing integrity checks between consumer-facing applications and core banking records.

The team also suggested monitoring bot-driven attempts, potential service disruption and abnormal API activity.

For utility providers, NCERT’s advice was to limit direct internet exposure and remote access and check the security of IoT assets and industrial control systems.

“Enforce OT/IT network segmentation and continuously monitor access to operational systems,” it recommended. “Keep applying security updates and maintain backup operating procedures for essential processes.”

NCERT also urged all organisations to check their preparedness against bot-driven AI cyberattacks, maintain incident logs and enhance arrangements for incident response, business continuity and security monitoring.