NCSC forecasts AI malware will hit UK infrastructure by 2028

The National Cyber Security Centre predicts that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028. The organization, which operates under the GCHQ spy agency, released this warning in its annual review published this week.

The centre defines critical national infrastructure as facilities and services across energy, transport, defence, food, health, and finance. The report states that AI will likely enable attackers to encrypt files on these systems and demand cryptocurrency payments to unlock them. This ransomware tactic is a standard tool for criminal hacker groups, many of which operate out of former Soviet Union states.

The NCSC identified specific ways AI will enhance these threats. Attackers can use the technology to scout targets, locate weaknesses in IT networks, and write malicious code. The body also warned that Russia and China will begin using AI routinely in cyber-attacks during the same period.

The government recently launched a campaign urging households to stockpile nine litres of bottled water and three days of food. Wes Streeting, the defence secretary, stated that Britain must prepare for state-sponsored terrorism targeting everyday infrastructure. He linked the need for physical supplies to the growing risk of cyber and weather emergencies.

Richard Horne, the chief executive of the NCSC, will address the public in a speech accompanying the review on Tuesday. He will describe the coming months as a period with a real prospect of a sharp rise in cyber incidents. Horne attributes this increase to AI’s ability to uncover IT weaknesses that organizations have tolerated for too long.

A recent example of this capability occurred last month when AI helped discover a critical weakness in PHP. This computer language is used by nearly 70% of the world's websites. The discovery illustrates how quickly artificial intelligence can root out vulnerabilities that human analysts might miss.

Alan Woodward, a professor of cybersecurity at Surrey University, commented on the NCSC warning. He said the report underlines the need for nation states and companies to access advanced AI technology. Woodward noted that AI can help find and patch flaws, but if organizations do not get access, adversaries will beat them to it. Leading companies like OpenAI and Anthropic have already given some firms advanced access to their most powerful models for this purpose.

Horne will also discuss the daily attacks on British military communications networks. He described these attacks as persistent and sustained. While he named Russia as one of the perpetrators, he noted that the attacks have deliberately stayed below the threshold of armed conflict. He characterized these actions as notable campaigns in an escalating hybrid warfare strategy.

The speech will reference recent cyber-attacks on supermarket fridges in Europe. Hackers raised the temperatures in these units to more than 50C. Horne will use this incident to urge companies to invest in cyber resilience. He will state that for decades, organizations have operated with cheap technology, and that era is ending.

The NCSC annual review serves as the primary source for these findings. The publication coincides with the launch of new preparedness guidelines for British households. The centre’s forecast sets a specific timeline for when AI-driven ransomware is expected to impact critical services.