cyber.hendryadrian.com
Security Report · cyble.com

NCSC Says AI-Powered Ransomware Against UK Critical Infrastructure Is Highly Likely by 2028

· Original article ↗

Summary

The NCSC’s 2026 annual review assesses that AI-powered malware is highly likely to be used in ransomware against UK critical infrastructure by 2028, and warns AI could accelerate existing attack methods and vulnerability discovery.

Key points

  • The NCSC assesses that AI-powered malware is highly likely to be used in a ransomware attack against UK critical national infrastructure by 2028.
  • The review describes AI as a force multiplier for reconnaissance, social engineering, vulnerability discovery, and exploit development; observed AI use had not enabled a new class of attack.
  • The NCSC says 88% of incidents affecting large organizations began through four vectors: public-facing applications, phishing, misuse of valid accounts, and external remote services.
  • The UK and EU member states attributed a December 2025 attack on Poland’s energy grid to Russia’s FSB Centre 16; if successful, it could have cut power to about 500,000 people.
  • Project DROMOS used frontier AI models to review government codebases and, when expanded into live environments, surfaced hundreds of potential security issues, including critical vulnerabilities.
  • The review highlights Cyber Shield, the National Detect Strategy, and faster vulnerability remediation as parts of the UK’s defensive response.
  • Recommendations for critical infrastructure operators include patching internet-facing systems, using phishing-resistant authentication, segmenting IT from operational technology, and governing internal AI use.

Article Details

Publisher
Cyble
Report Period
NCSC Annual Review 2026; discusses incidents and activity from 2025–2026 and assessments through 2028.
Scope
NCSC assessments of AI-enabled cyber threats, attacks on UK critical national infrastructure, European cyber incidents, and defensive initiatives.
Sample Size
The NCSC received 1,831 cyber attack reports over the past year; 337 required direct support and 80 were classified as nationally significant.
Key Statistics
  • The NCSC assessed it as highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028.
  • For large organizations, 88% of incidents began through four initial access vectors: public-facing application exploitation, phishing, misuse of valid accounts, and exploitation of external remote services.
  • The December 2025 attack on Poland’s energy grid could have cut power to around 500,000 people if successful.
  • UK government research cited in the review estimates the annual cost of malicious cyber activity to UK organizations at about £14.7 billion.
  • The NCSC reported that median time to fix domain-related vulnerabilities fell from 50 days to 8 under the Government Cyber Action Plan.
Recommendations
  • Inventory and patch internet-facing applications, VPNs, routers, and remote access services; prepare processes to deploy updates more rapidly.
  • Move privileged and remote users to phishing-resistant authentication where possible, and audit valid accounts for misuse.
  • Segment IT from operational technology, including PLCs and industrial control systems, and monitor boundaries continuously.
  • Govern internal AI use by mapping accessible data and permitted actions, monitoring agents, and addressing unsanctioned tools.
  • Rehearse ransomware recovery, strengthen supplier security controls, and monitor for newly disclosed vulnerabilities, stolen credentials, and sector-specific threat activity.

MITRE ATT&CK

T1078 · Valid AccountsThe review identifies misuse of valid accounts as one of four initial access vectors in incidents affecting large organizations.T1133 · External Remote ServicesThe review identifies exploitation of external remote services as one of four initial access vectors in incidents affecting large organizations.T1190 · Exploit Public-Facing ApplicationThe review identifies exploitation of public-facing applications as one of four initial access vectors in incidents affecting large organizations.T1566 · PhishingPhishing is identified as one of four initial access vectors in incidents affecting large organizations.

People

Anne Keast-ButlerGCHQ Director whose foreword to the review warns that tactics Russia developed against Ukraine are being used more widely against states and their institutions.

Threat Actors

Russia's FSB Centre 16UK and EU member states attributed the December 2025 attack on Poland’s energy grid to FSB Centre 16. The NCSC and international partners also reported FSB Centre 16 actors exploiting vulnerable routers to target critical national infrastructure networks worldwide.

Countries

ChinaBy 2028, China, Russia and other nation-states will highly likely be using AI-enabled cyber capabilities routinely to pursue geopolitical goals, with the UK facing sophisticated attacks at greater scale and speed.PolandThe review also recorded that UK and EU member states jointly attributed a December 2025 attack on Poland’s energy grid to Russia’s FSB Centre 16.RussiaBy 2028, China, Russia and other nation-states will highly likely be using AI-enabled cyber capabilities routinely to pursue geopolitical goals, with the UK facing sophisticated attacks at greater scale and speed.UkraineGCHQ Director Anne Keast-Butler goes further in the review’s foreword, warning that tactics Russia developed against Ukraine are now being turned more widely on states and their institutions.

Industries

Critical infrastructureChina is Best Positioned to Turn AI on Critical Infrastructure EnergyThe review also recorded that UK and EU member states jointly attributed a December 2025 attack on Poland’s energy grid to Russia’s FSB Centre 16.waterThe pattern matters for anyone running energy, water, transport or telecoms in Europe.