Britain on notice: AI-powered ransomware attacks to arrive by 2028

The UK's National Cyber Security Centre (NCSC) predicts AI-powered ransomware attacks targeting critical national infrastructure in Britain between now and 2028. The warning comes alongside the NCSC's annual review and a separate assessment on how AI could alter cyber threats in the next two years. GCHQ, the UK's cyber intelligence agency, did not detail the form this AI malware may take but suggested that open-source AI security tools, initially meant for security researchers, may be repurposed for malicious purposes.

These tools are already being misused, as seen in attacks on UK registrar 123 Reg and Microsoft 365 using ARTEX, a Chinese-made AI red-teaming platform. The NCSC's pessimistic scenario for 2028 envisions a significant increase in the frequency and sophistication of cyberattacks worldwide, making attribution more challenging. A further threat is an autonomous attacker operating beyond human control, which could self-replicate and conduct cyberattacks without restraint, complicating geopolitical relationships.

The NCSC is also exploring AI's role in vulnerability discovery and patching, with a project called DROMOS already uncovering hundreds of potential security issues. Plans for an agentic cyber defense system, Cyber Shield, are in the works and will be rolled out over the next five years. The government has allocated £60 million to fund this initiative, along with £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre to identify and maintain a comprehensive understanding of vulnerabilities across critical national infrastructure organizations and the wider economy.