UK Cyber Agency Warns AI-Powered Ransomware Likely to Hit Critical Infrastructure by 2028
The UK's National Cyber Security Centre said Tuesday it is highly likely AI-powered malware will feature in a ransomware attack on critical national infrastructure by 2028. The warning came with its annual State of the Cyber Nation review and new government funding for national cyber defenses.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What the NCSC Forecast
The UK's National Cyber Security Centre (NCSC) says it is "highly likely" that AI-powered malware will feature in a ransomware attack on the country's critical national infrastructure before 2028. The forecast was published in the agency's annual State of the Cyber Nation report, which NCSC CEO Richard Horne presented in a speech. The NCSC is part of GCHQ, the UK's signals intelligence service.
The report says hostile actors' use of AI is "highly likely" to increase the scale and efficiency of their operations over the next two years. The areas it names are ransomware, social engineering and the exploitation of software vulnerabilities. It does not specify what form the AI-driven malware would take.
A Familiar Threat, Amplified
Horne said AI is not inventing new methods of attack. In his prepared remarks, he argued that longstanding weaknesses are now being found and exploited "at a scale that was once unimaginable." He tied the problem to years of underinvestment, saying the country had "for decades" done technology "on the cheap."
He urged organizations to invest properly in their technology, avoid connecting systems to the internet unnecessarily, and treat Cyber Essentials certification as a baseline rather than a finish line. Sources differ slightly on the tone of his warning about leadership accountability: Decrypt quotes him saying leaders who fail to act could have to explain to investors, staff and customers why "food isn't on shelves, lights aren't on," while the Crypto Briefing piece characterizes the assessment more generally as pointing to amplified exposure of existing gaps.
Threat Actors and Scale
The NCSC singles out hostile states, with China identified as the most significant concern. According to the report, there is a "high likelihood" China will use AI against UK critical national infrastructure, and the agency expects state actors to accelerate their adoption of AI for cyber operations. The report also flags criminal gangs.
The agency's operational figures cover the year to August 31, 2026. It received 1,831 cyberattack reports, supported 337 incidents, and classed 80 as nationally significant. It estimates malicious cyber activity costs UK organizations £14.7 billion per year.
Evidence of Attackers Using AI
The forecast follows reported cases of AI use in real attacks, though the sources weigh the evidence differently. Decrypt cites Google's Threat Intelligence Group, which said in May that cybercriminals had used an AI model to find and weaponize a previously unknown flaw that bypassed two-factor authentication in a popular open-source administration tool. Google described it as the first confirmed case of AI-assisted zero-day development in the wild. A Cambridge University study of more than 90,000 cybercrime forum threads, published the same month, found most criminals used AI for spam and phishing rather than sophisticated attacks. The two findings point in different directions on how advanced current AI-enabled crime is.
Government Funding Response
The warnings were paired with government funding announcements. The package includes £60 million (about $80 million) for the first phase of a national Cyber Shield, and £70 million (about $93 million) for a new National Exposure and Real-Time Vulnerability Centre to identify weaknesses across critical infrastructure. A new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC, is also planned.
The announcements come after earlier official warnings about AI. In July, Foreign Secretary Yvette Cooper wrote that governments must agree on AI safeguards before frontier systems transform warfare, crime and society, adding, "We cannot afford to wait for an AI equivalent of Hiroshima before we act."
Why It Matters
For Traders
The forecast is a policy and security assessment with no direct price catalyst, so it is unlikely to move crypto markets within the next 24-72 hours.
For Investors
Sustained government funding for national cyber defense and AI security signals rising compliance and infrastructure spending that could shape the sector over several years.
For Builders
Developers of wallets, exchanges and infrastructure should expect tighter scrutiny of internet-exposed systems and AI-assisted vulnerability discovery in critical services.
This article is for information only and is not financial advice. Read the full disclaimer.
