UK Cyber Agency Forecasts AI Ransomware Strikes on Critical Sites by 2028

The National Cyber Security Centre (NCSC) has determined that AI-powered malware is highly likely to be deployed in ransomware attacks against UK critical national infrastructure by 2028. This assessment appears in the organization's annual review, which identifies the period between now and 2028 as the window when such strikes are expected to occur.

The UK defines critical national infrastructure to include energy, transport, defence, food, health, and finance sectors. The NCSC, a part of the GCHQ agency, warned that Russia and China will begin using AI routinely in their cyber-operations. The agency noted that AI will assist attackers in scouting targets, identifying network weaknesses, and writing malicious code, thereby enhancing the existing ransomware threat.

Ransomware gangs, often based in former Soviet Union states, typically gain access to victim systems to encrypt files and demand cryptocurrency payments. Recent UK victims of these attacks have included Royal Mail, the outsourcing firm Capita, and several local councils. The NCSC stated that AI will help these groups overcome technical hurdles more efficiently than before.

Last month, the government launched the Be Ready campaign, urging residents to stockpile nine litres of bottled water and three days of food. Defence Secretary Wes Streeting framed this preparation as a response to state-sponsored terrorism, specifically citing threats from Russia and other hostile powers targeting everyday infrastructure.

Richard Horne, the NCSC chief executive, will present the findings in a speech on Tuesday. He stated that the UK faces a real prospect of an unprecedented rise in cyber incidents in the coming months. Horne attributed this surge to AI’s ability to uncover IT weaknesses that have been tolerated for too long. He cited a recent discovery of a critical weakness in PHP, a language used by nearly 70% of global websites, as an example of AI’s capacity to find hidden vulnerabilities.

Alan Woodward, a cybersecurity professor at Surrey University, argued that nations and companies must access advanced AI technology to counter this threat. He noted that while AI can help patch flaws, lack of access could allow adversaries to exploit them first. Major AI companies like OpenAI and Anthropic have provided advanced model access to some firms to help identify serious IT glitches.

Horne’s speech will also detail daily persistent and sustained attacks on British military communications networks. He identified Russia as a perpetrator, noting that Moscow’s campaigns intentionally remain below the threshold of armed conflict to escalate hybrid warfare efforts. The NCSC chief also pointed to recent cyber-attacks on European supermarket fridges, where hackers raised temperatures above 50C, as a signal for organizations to invest in cyber resilience.

The NCSC concluded its review by stating that the era of cheap technology has ended. Horne will tell the public that for decades, organizations have relied on low-cost tech solutions, but the current threat environment requires stronger investment in defensive capabilities to withstand AI-driven attacks.