UK cyber chief: AI-powered ransomware 'highly likely' to hit critical infrastructure by 2028

LONDON — Britain's cyber security agency said it is highly likely that AI-powered malware will be used in a ransomware attack on the country's critical national infrastructure by 2028, warning that hostile states are already mounting sustained campaigns against military and strategic networks.

The National Cyber Security Centre, part of the GCHQ spy agency, published the assessment in its annual State of the Cyber Nation report on Tuesday, alongside a speech by chief executive Richard Horne warning of "a real prospect of an unprecedented rise in the number of cyber incidents" in the coming months.

Horne attributed the projected escalation not to novel attack techniques but to weaknesses that have gone unfixed. "AI makes cyber attacks easier, faster and cheaper to execute, and at greater scale," he said, adding that "the cyber threat has increased faster than our defensive capabilities, leaving too many organisations vulnerable to attacks that could – and should – be prevented."

The report states that "by 2028, it is highly likely China, Russia, and other nation states will routinely use AI cyber to achieve their geopolitical goals with the UK facing an increase in scale and speed of sophisticated cyber attacks." It adds that AI-powered malware will probably have featured in a ransomware strike on UK critical national infrastructure over the same period.

UK critical national infrastructure spans energy, transport, defence, food, health and finance, as well as emergency services.

China named as most capable

Horne singled out Beijing as the most formidable of the threats. "We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets with their activity representing the most sophisticated and sustained cyber challenge the UK faces," he was due to say.

Russia, he said, is making sustained attempts to penetrate UK military networks, while Iran is conducting malicious cyber operations globally, including against the UK and individuals seen as threats to Tehran. Moscow, Beijing and Tehran have all repeatedly denied similar accusations of malevolent cyber activity in the past.

According to the Guardian, Horne will describe attacks on communications networks used by the British military as "persistent" and "sustained," with Russia among the perpetrators, and will say the campaigns deliberately fall "below the threshold of armed conflict as they escalate their attempts at hybrid warfare."

Fridge attacks 'just the foothills'

The report lands after hackers struck refrigeration systems at supermarkets across Europe, from Sweden to Belgium and France, forcing stores to discard large quantities of food. The Guardian reported that fridge temperatures were raised by attackers to more than 50C.

Horne described the incident as "just the foothills, as it were." NCSC officials said advanced AI would probably not have been required for the attacks, which exploited known vulnerabilities in legacy technology — but Horne argued AI will make such flaws far easier to find and exploit at scale.

The Economic Times reported that the US Army Criminal Investigation Division's Cyber Field Office was involved in investigating separate refrigeration outages at military bases across the United States in August, and was working with French law enforcement to understand the European incidents.

The NCSC chief said too many British organisations and supply chains had got away with "doing tech on the cheap" for decades. The report flags "preventable weaknesses" including unpatched software and poor password protection.

Organisations must act now, Horne said, or later explain why "when food isn't on shelves, lights aren't on, businesses have gone under … that we saw the warning signs, understood the risks and still didn't make the right choices."

Wider breach record

The warning follows a run of major intrusions. Jaguar Land Rover was crippled last year after hackers broke into its computer systems and hit vehicle production, the Daily Mail reported. The same outlet noted the largest hack on record, at cryptocurrency exchange Binance.

Binance said in a postmortem that the attack was a months-long campaign that began in June when an engineer downloaded a tampered software package while setting up an AI coding tool, culminating in the Oct. 29 theft of roughly $6.3 billion in digital assets, according to Cointelegraph. The exchange said $2.85 billion had been frozen or intercepted and that it would absorb the losses. The FBI has attributed the hack to North Korean hackers, a claim Pyongyang denied.

The Guardian reported that the government last month urged Britons to stock up to nine litres of bottled water and three days' worth of food under its Be Ready campaign, with defence secretary Wes Streeting citing the threat of "state-sponsored terrorism." The newspaper also reported that AI helped uncover a critical weakness last month in PHP, a computer language used by almost 70% of the world's websites, and quoted Alan Woodward, a professor of cybersecurity at Surrey University, saying: "AI can help people find these flaws and patch them, but if we don't get the access the bad guys will beat them to it."

Horne framed the response as "a moment of choice" — either cyber security becomes "a source of national strength," or inaction leaves attacks "more frequent, more severe and more costly."