Banks, utilities among services put on alert against AI-enabled cyberthreats

The National Cyber Emergency Response Team (NCERT) has warned of an increased use of artificial intelligence (AI) and automated bots to carry out credential-based and coordinated cyberattacks, noting that critical infrastructure and financial services are at particular risk.

NCERT, in an advisory dated Nov 5, said an increase in “AI, automated bots, botnets and agentic tools to automate reconnaissance, identify vulnerabilities, conduct credential-based attacks and launch coordinated cyberattacks” has been observed recently.

“These capabilities may help threat actors and sophisticated cybercriminal groups to broaden the scale, speed and sophistication of their operations,” it added.

“This advisory is relevant to all sectors/organizations. However, two sectors require particular attention,” it stressed, referring to financial services, along with operational technology (OT) and critical infrastructure.

It warned banks that they could face attacks targeting core banking systems, digital banking platforms, payment systems and customer-facing applications, with potential scenarios including the disruption of online services, automated credential attacks, and manipulation of displayed account balances.

In terms of critical infrastructure, NCERT warned: “Third-party service providers, connected IoT (internet of things) devices, vulnerabilities in industrial control systems and insecure remote access may expose oil and gas facilities, water utilities, power generation and distribution networks, manufacturing, transportation and other essential services.

“A compromise could disrupt physical processes and critical services,” it added.

NCERT cited recent incidents in Europe, where supermarket refrigerators and freezers were targeted in cyberattacks, as examples of the “physical and commercial consequences of attacks against connected operational systems”.

“However, AI involvement in said incidents has not been confirmed yet,” it added.

Threat indicators

The advisory listed anomalies which may indicate a potential cyberattack targeting financial institutions, such as frequent automated login attempts, repeated authentication failures, and unusual application programming interface (API) requests.

Abnormal transaction patterns, differences between core banking records and the displayed account balance, and unauthorised payment access were other indicators.

For critical infrastructure, NCERT said changes to refinery, pipeline, grid, power generation or distribution parameters could indicate an attack, as could unexpected changes to pressure, temperature, cooling or heating control settings.

Unexpected remote access sessions or changes to IoT/OT device configurations could also point towards a cyberattack.

Recommendations

NCERT recommended that financial institutions check their core banking security, APIs, third-party integrations, payment gateways and digital banking applications.

It further urged them to use multi-factor authentication and protection against automated login attempts, while enforcing integrity checks between consumer-facing applications and core banking records.

The team also suggested monitoring bot-driven attempts, potential service disruption and abnormal API activity.

For utility providers, NCERT’s advice was to limit direct internet exposure and remote access and check the security of IoT assets and industrial control systems.

“Enforce OT/IT network segmentation and continuously monitor access to operational systems,” it recommended. “Keep applying security updates and maintain backup operating procedures for essential processes.”

NCERT also urged all organisations to check their preparedness against bot-driven AI cyberattacks, maintain incident logs and enhance arrangements for incident response, business continuity and security monitoring.