UK Cybersecurity Body Predicts AI-Driven Ransomware Threats by 2028

The National Cyber Security Centre, the UK's state cybersecurity body, has issued a stark warning that artificial intelligence powered malware is highly likely to be deployed in ransomware attacks against critical national infrastructure by 2028. The organization, which operates as part of the GCHQ spy agency, detailed this forecast in its annual review. The scope of critical national infrastructure in the UK is broad, encompassing essential services and facilities across the energy, transport, defence, food, health, and finance sectors.

According to the NCSC, the integration of AI into cybercriminal operations will significantly enhance the threat landscape. The agency stated that it is highly probable that between now and 2028, AI tools will facilitate a ransomware attack on these vital systems. Ransomware has become a primary method for criminal hackers, particularly gangs often associated with former Soviet Union states. These attackers typically infiltrate a victim's IT systems, encrypt files using bespoke malicious software, and demand cryptocurrency payments to unlock the systems and return stolen data. Notable UK victims in recent years have included Royal Mail, the outsourcing firm Capita, and various local councils and public bodies.

The NCSC explained that AI will assist attackers in several key areas, such as scouting potential targets, identifying weaknesses in IT networks, and writing malicious code. This technological advantage is expected to streamline the attack process and increase its effectiveness. The annual review also highlighted that Russia and China are expected to begin using AI routinely in their own cyber-attacks, further intensifying the competitive and hostile environment in digital security.

In a speech accompanying the release of the review, NCSC Chief Executive Richard Horne will warn the public of an imminent wave of cyber-attacks. He is expected to state that in the coming months, there is a real prospect of an unprecedented rise in cyber incidents. Horne will attribute this surge to the technology's growing ability to uncover vulnerabilities in IT systems that have been tolerated for far too long. He will emphasize that these previously undetected flaws are becoming increasingly exposed by advanced AI tools.

A recent example of this capability was demonstrated last month when AI technology helped discover a critical weakness in PHP, a computer language that powers almost 70 percent of the world's websites. This incident serves as a concrete illustration of how AI can root out hidden vulnerabilities. Horne will use this example to underline the urgency of addressing these security gaps before they are exploited by malicious actors.

The warning from the NCSC aligns with recent government advice urging the public to prepare for serious emergencies. Last month, the government encouraged Britons to stockpile nine litres of bottled water and three days' worth of food to ensure household resilience against weather, cyber, or other severe disruptions. Wes Streeting, the defence secretary, noted at the launch of the Be Ready campaign that Britain must prepare for the threat of state-sponsored terrorism, with Russia and other hostile powers targeting everyday infrastructure.

Alan Woodward, a professor of cybersecurity at Surrey University, commented that the NCSC's warning underscores the need for both nation states and private companies to gain access to cutting-edge AI technology. He noted that while AI can help identify and patch flaws, organizations must secure access to these tools quickly. Otherwise, malicious actors will exploit the vulnerabilities first. Currently, leading AI companies such as OpenAI and Anthropic are providing advanced access to their most powerful models for some companies to help identify serious IT glitches.

Horne will also address the ongoing threats facing the British military's communications networks. He will describe these networks as being subjected to daily attacks that are both persistent and sustained. While Russia has been identified as one of the perpetrators, Horne will explain that these attacks have deliberately not crossed the line into full-scale warfare. Instead, Moscow is carrying out notable campaigns that intentionally fall below the threshold of armed conflict as part of an escalation in hybrid warfare tactics.

The speech will conclude with a cautionary note about the importance of cyber resilience. Horne will reference recent cyber-attacks on supermarket fridges in Europe, where hackers raised the internal temperatures to more than 50 degrees Celsius. He will use this incident to warn companies and organizations that they must invest strongly in their cyber defenses. He will remark that for decades, the collective approach has been to rely on cheap technology, a strategy that is becoming increasingly risky in the current threat environment.