UK Says AI-Powered Ransomware Attack on Critical Infrastructure 'Highly Likely' by 2028

Britain's critical national infrastructure should be braced for a ransomware attack involving AI-powered malware by 2028, the UK's National Cyber Security Centre warned on Tuesday.

Within the next two years, hostile actors' use of AI is "highly likely" to increase the scale and efficiency of their operations, including ransomware, social engineering and the exploitation of software vulnerabilities, according to the NCSC's annual State of the Cyber Nation report. The agency is part of GCHQ, the UK's signals intelligence service.

The threat stems less from new attack techniques than from old weaknesses, NCSC chief executive Richard Horne said in prepared remarks for a speech launching the report.

"In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents," Horne said. "But we must be clear that is not because AI has invented new ways to attack us. But because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable."

"For decades, we have collectively got away with doing tech on the cheap," he added.

Horne urged organizations to invest properly in their technology, stop connecting systems to the internet unnecessarily, and treat the government's Cyber Essentials certification as the starting point for their security rather than the end goal. Leaders who fail to act could have to explain to investors, staff and customers why "food isn't on shelves, lights aren't on, businesses have gone under," he warned.

The government last week announced £60 million (about $80 million) for the first phase of a national Cyber Shield, £70 million ($93 million) for a new National Exposure and Real-Time Vulnerability Centre to identify weaknesses across critical infrastructure, and a new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC.

AI and cyberattacks

The warning follows growing evidence that attackers are already putting AI to work. In May, Google's Threat Intelligence Group said cybercriminals had used an AI model to find and weaponize a previously unknown flaw that let them bypass two-factor authentication in a popular open-source administration tool, the first time it had confirmed AI-assisted zero-day development in the wild. A Cambridge University study of more than 90,000 cybercrime forum threads published the same month, however, found that most criminals were using AI for spam and phishing rather than sophisticated attacks.

UK officials have sounded the alarm before. In July, Foreign Secretary Yvette Cooper warned that governments must agree on AI safeguards before frontier systems transform warfare, crime and society. "We cannot afford to wait for an AI equivalent of Hiroshima before we act," she wrote.