UK faces ‘highly likely’ AI-powered ransomware attack on critical infrastructure by 2028, NCSC warns

LONDON (The Wiregazette) — Britain should brace for a ransomware attack using AI-powered malware against its critical national infrastructure by 2028, the National Cyber Security Centre warned Tuesday, saying artificial intelligence will let hostile states find and exploit long-tolerated vulnerabilities at once-unimaginable scale.

In its annual report, the NCSC said it was “highly likely” there would be a ransomware attack involving AI-powered malware on the nation’s critical infrastructure within that timeframe, which spans defence, energy, transport, food, health, emergency services and finance. The report also warned that China, Russia and other nation states will “routinely” use AI-enabled cyber operations to pursue geopolitical goals.

Richard Horne, the NCSC’s chief executive, said UK resilience to hacks is “not where it should be” and that the cyber threat has outpaced defensive capabilities. “The cyber threat has increased faster than our defensive capabilities, leaving too many organisations vulnerable to attacks that could – and should – be prevented,” he said in remarks accompanying the report. “AI makes cyber attacks easier, faster and cheaper to execute, and at greater scale.”

Horne framed the choice facing UK organisations as a “moment of choice,” warning of “a real prospect of an unprecedented rise in the number of cyber incidents” in coming months. “But we must be clear that is not because AI has invented new ways to attack us,” he said, “but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.”

Horne singled out China as the most capable AI threat. “We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets,” he said, describing its activity as the most sophisticated and sustained cyber challenge the UK faces. He also said Russia was making sustained attempts to penetrate UK military networks, while Iran was carrying out malicious cyber operations globally, including against the UK and individuals seen as threats. Moscow, Beijing and Tehran have repeatedly denied similar accusations in the past, according to Reuters.

The report highlighted “preventable weaknesses” such as unpatched software and poor password protection, suggesting some organisations are not taking the threat seriously. Horne said decades of “doing tech on the cheap” had left many companies and supply chains exposed.

The warning lands amid a succession of high-profile incidents. Horne said recent hacking attacks on supermarket refrigeration systems across Europe — which raised fridge temperatures to above 50C and forced stores to discard large amounts of food, according to the Guardian — were “just the foothills, as it were.” NCSC officials said the fridge attacks probably did not require advanced AI, targeting known flaws in old technology, but Horne said AI would make it increasingly easy to discover and exploit such weaknesses at huge scale. Selected incidents detailed by the Daily Mail include last year’s outage at Jaguar Land Rover, which hit vehicle production.

According to the Guardian, AI has already shown its offensive potential: last month the technology helped discover a critical weakness in PHP, a computer language used by nearly 70% of the world’s websites. Alan Woodward, a professor of cybersecurity at Surrey University, said the NCSC warning underlined the need for states and companies to access cutting-edge AI. “AI can help people find these flaws and patch them, but if we don’t get the access the bad guys will beat them to it,” he said.

The Guardian also reported that Horne will say Britain’s military communications networks face daily “persistent” and “sustained” attacks, with Russia conducting campaigns that “intentionally fall below the threshold of armed conflict as they escalate their attempts at hybrid warfare.” The warning comes a month after the government urged Britons to stockpile water and food under its “Be Ready” campaign, with Defence Secretary Wes Streeting citing the threat of “state-sponsored terrorism” against everyday infrastructure.

The NCSC assessment comes days after the largest cryptocurrency hack on record. Binance said $6.3 billion in digital assets was stolen in a coordinated campaign that began in June, when an engineer downloaded a tampered software package, and concluded with attackers obtaining deployment credentials and gaining access to the exchange’s internal wallet-signing service. Binance said it had frozen or intercepted $2.85 billion and replenished 98% of affected token assets as of Oct. 31, absorbing the losses rather than passing them on to customers. The FBI has attributed the attack to North Korean hackers, a claim denied by Kim Yo Jong, sister of North Korean leader Kim Jong Un, who called it politically motivated. Binance co-founder Yi He said the exchange had detected and prevented 57 suspected North Korea-linked cyber threats this year, adding: “We intercepted many of them, but the cost of failing to stop even one was severe—and this should never have happened.”

Separately, the Economic Times reported that the Pentagon was treating a spate of mysterious freezer malfunctions that spoiled food at US military bases in August as a suspected hack, with the Army’s Criminal Investigation Division working with French law enforcement on the refrigeration outages in Europe.