UK Cyber Agency: AI Malware Will Hit Critical Infrastructure by 2028

AI-powered malware is "highly likely" to be used in a ransomware attack on UK critical national infrastructure between now and 2028, according to the National Cyber Security Centre. The warning targets the systems behind the country's power stations, airports and hospitals.

The NCSC, the state cybersecurity body that sits inside the GCHQ spy agency, published the assessment in its annual review. It also warned that Russia and China will start using AI "routinely" in cyber-attacks.

"It is … highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI," the NCSC said. The UK's definition of critical national infrastructure spans facilities and services across energy, transport, defence, food, health and finance.

Why ransomware is the core threat?

Ransomware has become a cornerstone of the criminal hacker's repertoire. It's a signature ploy of gangs that typically operate out of former Soviet Union states.

The mechanics are simple and brutal. After gaining access to a victim's IT systems, attackers encrypt files with bespoke malicious software. Then they demand payment in cryptocurrency to unlock the crippled systems and return any stolen data.

UK victims already include Royal Mail, outsourcing firm Capita and a range of public bodies, including councils. The NCSC expects AI to sharpen the threat by helping attackers scout targets, locate weaknesses in IT networks and write malicious code.

What will NCSC's chief executive say?

Richard Horne, the NCSC's chief executive, will deliver the public message in a speech accompanying the review on Tuesday. His core claim: AI is set to unleash a wave of cyber-attacks imminently.

"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," he will say.

Horne will attribute the danger to the technology's ability to uncover weaknesses in IT systems that have been "tolerated for far too long". Recent events back that up. Last month, AI helped discover a critical weakness in PHP, a computer language used by almost 70% of the world's websites.

Alan Woodward, a professor of cybersecurity at Surrey University, said the NCSC's warning underlines the need for nation states and companies to secure cutting-edge AI technology.

"AI can help people find these flaws and patch them, but if we don't get the access the bad guys will beat them to it," Woodward said. Leading AI companies like OpenAI and Anthropic have so far given some firms advanced access to their most powerful models to help them identify serious IT glitches.

Who is attacking military networks?

Horne will say in his speech that communications networks used by the British military face daily attacks that are "persistent" and "sustained". Russia is one of the perpetrators, he will say — but the attacks have deliberately stopped short of open warfare.

Moscow has carried out "notable campaigns" that "intentionally fall below the threshold of armed conflict as they escalate their attempts at hybrid warfare", according to Horne's prepared remarks.

He will also point to recent cyber-attacks on supermarket fridges in Europe, where hackers raised fridge temperatures to more than 50C. That, he will say, is a warning to companies and organisations to invest strongly in cyber resilience.

"For decades we have collectively got away with tech on the cheap," Horne will say.

How is the government responding?

Last month, the government urged Britons to stock up to nine litres of bottled water and three days' worth of food so households can survive a weather, cyber or other serious emergency. Wes Streeting, the defence secretary, said at the launch of the Be Ready campaign that Britain needed to prepare for the threat of "state-sponsored terrorism" by Russia or other hostile powers targeting everyday infrastructure.

The through-line of the NCSC's review is a deadline. Organisations running UK critical infrastructure have, at most, until 2028 to close the vulnerabilities AI is about to find for them.