Bad newsUK Cyber Agency Expects AI-Powered Ransomware Against Critical Infrastructure by 2028
The National Cyber Security Centre judges it highly likely that AI-powered malware will be used in a ransomware attack on UK critical infrastructure by 2028, and warns that long-tolerated weaknesses will be found faster than they are fixed.
This story runs on the bad side only. The biggest stories of the day are told on both sides.
Britain’s cyber agency expects the next big ransomware attack on its power stations, airports or hospitals to use artificial intelligence. The National Cyber Security Centre (NCSC), part of GCHQ, judged it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. It said so in its State of the Cyber Nation report, published on Tuesday.
The NCSC says hostile actors will use AI to raise the scale and efficiency of ransomware, social engineering and the hunt for software flaws. It also stresses limits. Its annual review says AI is more likely to speed up existing methods than to create new ones, and that adoption among attackers is uneven. Skilled operators gain the most.
The warning that matters for ordinary organisations is about old weaknesses. NCSC chief executive Richard Horne is due to say that the UK faces a “real prospect of an unprecedented rise in the number of cyber incidents”. The cause, he will say, is that flaws tolerated for years can now be found and exploited at scale. He describes a country that has spent decades doing “tech on the cheap”.
The Guardian adds an example from last month, when AI helped uncover a critical weakness in PHP, a language used by almost 70 percent of the world’s websites. Alan Woodward, a cybersecurity professor at Surrey University, told the paper that defenders need access to the same cutting-edge models or attackers will get there first. Leading AI developers have so far given some companies early access to their most powerful models to find serious flaws.
What is being done, and what is not
The government says it is responding. Last week the Chancellor announced £60 million for the first phase of a national Cyber Shield and £70 million for a National Exposure and Real-Time Vulnerability Centre. A new AI Cyber Security Centre of Excellence will open in Manchester. A Cyber Security and Resilience Bill and a National Cyber Action Plan are due.
The record so far is mixed. The Guardian lists Royal Mail, the outsourcer Capita and several councils among UK ransomware victims. Horne will also say that British military communications networks face daily, persistent attacks, and that Russia runs campaigns designed to stay below the threshold of armed conflict. He points to recent attacks that pushed supermarket fridge temperatures above 50C in Europe.
Horne wants boards to invest, to keep unnecessary systems off the internet and to treat Cyber Essentials as a starting point. Neither source gives a figure for how many UK infrastructure operators meet that standard today, or says what the spending announced will cover. Last month the government also told households to keep nine litres of bottled water and three days of food in case of a cyber or other emergency, the Guardian says.
