NCSC forecasts AI ransomware attacks on UK power, transport by 2028

The National Cyber Security Centre (NCSC) has warned that artificial intelligence powered malware will likely be used to attack UK critical national infrastructure by 2028. The agency, which operates under GCHQ, identified the threat in its annual review. The review also stated that Russia and China will begin using AI routinely in cyber attacks.

The NCSC defines critical national infrastructure to include facilities and services in energy, transport, defence, food, health, and finance. The agency said it is highly likely that between now and 2028, AI powered malware will have been used in a ransomware attack on these systems. Ransomware involves encrypting a victim's files and demanding payment in cryptocurrency to unlock them.

The NCSC stated that AI will help attackers scout targets, locate weaknesses in IT networks, and write malicious code. This technology enhances the threat posed by criminal gangs, many of which operate out of former Soviet Union states. UK victims of previous ransomware attacks have included Royal Mail, the outsourcing firm Capita, and various local councils.

Richard Horne, the chief executive of the NCSC, will address the public in a speech on Tuesday. He will state that the country faces a real prospect of a rise in the number of cyber incidents. Horne attributed this threat to the technology’s ability to uncover weaknesses in IT systems that have been tolerated for far too long.

A recent example of this capability occurred last month when AI helped discover a critical weakness in PHP. PHP is a computer language used by almost 70% of the world’s websites. This discovery illustrates how the technology can root out previously undetected vulnerabilities in software.

Alan Woodward, a professor of cybersecurity at Surrey University, noted that the warning underscores the need for nation states and companies to access advanced AI technology. Woodward stated that AI can help people find flaws and patch them, but if organizations do not get access, the bad guys will beat them to it. Leading AI companies like OpenAI and Anthropic have given some companies advanced access to their most powerful models to help identify serious IT glitches.

The government urged Britons last month to stock up on nine litres of bottled water and three days' worth of food. This advice was part of the Be Ready campaign launched by Defence Secretary Wes Streeting. Streeting said Britain needed to prepare for the threat of state sponsored terrorism by Russia or other hostile powers targeting everyday infrastructure.

Horne will also say that communications networks used by the British military are subjected to daily attacks that are persistent and sustained. He identified Russia as one of the perpetrators, noting that the attacks have deliberately not crossed the line into warfare. Moscow has carried out notable campaigns that intentionally fall below the threshold of armed conflict as they escalate their attempts at hybrid warfare.

Horne added that recent cyber attacks on supermarket fridges in Europe serve as a warning to companies. Hackers raised the temperatures in these fridges to more than 50C. He said that for decades, organizations have collectively got away with tech on the cheap, and now they must invest strongly in cyber resilience.