UK cyber agency says AI-powered malware is 'highly likely' to be used in a ransomware attack on national infrastructure by 2028

The National Cyber Security Centre says it is "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028.

The assessment appears in the NCSC's annual review, published today, Nov. 3. The NCSC is part of the GCHQ spy agency. UK critical national infrastructure covers energy, transport, defence, food, health and finance.

"It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI," the review states.

This is a forecast. The NCSC is not reporting an attack that has already happened.

What the NCSC says AI changes

The agency says AI will help attackers scout targets, find weaknesses in IT networks and write malicious code. It expects that to raise the scale and efficiency of ransomware, social engineering and vulnerability exploitation.

The review also says Russia and China will use AI "routinely" to pursue their geopolitical goals. It calls Chinese cyber activity the "most sophisticated and sustained cyber challenge facing the U.K."

Horne, the NCSC's chief executive, said in a speech marking the review's publication that the UK faces "a real prospect of an unprecedented rise in the number of cyber incidents." He said AI will let "vulnerabilities that have been tolerated for far too long" be found and exploited "at a scale that was once unimaginable."

The review is more measured than that headline line. It says AI is more likely to enhance and scale existing tactics than to discover brand-new vulnerabilities.

A message to the boardroom

Horne put the blame for exposure squarely on leadership. Executives who have "got away with tech on the cheap" will have to explain why "food isn't on the shelves, lights aren't on, businesses have gone under" if they fail to invest in security or replace outdated technology, he said.

He described the physical stakes: electricity switching, sluice gates in water facilities, dam operations, manufacturing lines, heating and refrigeration controls. He pointed to recent cyberattacks on refrigeration systems in French supermarkets as proof that civilian infrastructure is easy to exploit.

The NCSC put the cost of malicious cyber activity to UK organizations at almost $20 billion a year. Jaguar Land Rover suffered more than $260 million in direct losses in 2025 after a cyberattack that also hit its suppliers and dented the UK economy.

UK victims of ransomware have included Royal Mail, the outsourcer Capita and various public bodies, including councils.

Nation-states in the mix

Horne said Russia is deliberately running cyber campaigns that fall below the threshold of armed conflict. He said Iran is attacking the UK and targeting people it sees as a threat to the Iranian regime.

The UK and EU member states have said Russia's FSB security service was behind an attack on Poland's energy grid in December 2025. If it had succeeded, 500,000 people could have lost electricity in winter.

The NCSC also reported persistent spear-phishing against high-risk individuals such as politicians and officials, and growing efforts to compromise messaging apps. In March, Dutch intelligence agencies warned that Russian state hackers were impersonating Signal support to hijack accounts of officials, military personnel and civil servants.

"Technology has always influenced cyber security. What is different today is the pace," the NCSC said.

The PHP flaws

Horne's example of AI finding weaknesses is recent. Two critical flaws in PHP, a programming language used by roughly 70% of websites worldwide, were discovered with AI assistance. The flaws could let attackers gain unauthenticated access to sites and, in theory, control a web server remotely without a password. Governments and corporations have been working on urgent security updates.

Alan Woodward, a cybersecurity professor at Surrey University, said the warning underlines the need for states and companies to have access to cutting-edge AI. "AI can help people find these flaws and patch them," he said.

Government preparedness

The warning follows last month's launch of the government's Be Ready campaign. It urged households to keep up to nine litres of bottled water and three days of food in case of a weather, cyber or other serious emergency.

Wes Streeting said at the launch that Britain needed to prepare for "state-sponsored terrorism" by Russia or other hostile powers targeting everyday infrastructure.

What comes next

The NCSC's window runs to 2028, but Horne framed the risk as near-term, referring to "the coming months." The agency has not said which sector it expects to be hit first.

The defence it is pushing is unglamorous: patch known flaws and replace legacy systems. The PHP updates now being rolled out are the first test of whether operators move that fast.