AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028

National Cyber Security Centre expects attacks on critical facilities such as power stations, airports and hospitals

AI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power stations, airports and hospitals by 2028, according to the state cybersecurity body.

The National Cyber Security Centre (NCSC) said AI will probably enable a ransomware attack against critical national infrastructure [CNI] between now and 2028. The UK’s definition of CNI covers a range of facilities and services across sectors including energy, transport, defence, food, health and finance.

The warning from the NCSC, part of the GCHQ spy agency, was published in the organisation’s annual review, which also warned that Russia and China will start using AI “routinely” in cyber-attacks.

“It is … highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI,” said NCSC.

Ransomware has become a cornerstone of the criminal hacker’s repertoire and is a signature ploy of gangs that typically operate out of former Soviet Union states.

After gaining access to a victim’s IT systems, the attackers then encrypt files with bespoke malicious software – or malware – and then demand a payment in cryptocurrency to unlock the crippled systems and return any stolen data. UK ransomware victims include Royal Mail, outsourcing firm Capita and various public bodies, including councils.

AI is set to enhance the ransomware threat by helping attackers with tasks such as scouting targets, locating weaknesses in IT networks and writing malicious code, said the NCSC.

Last month, the government urged Britons to stock up to nine litres of bottled water and three days’ worth of food in order to ensure that households can survive a weather, cyber or other serious emergency. Wes Streeting, the defence secretary, said as the Be Ready campaign was launched that Britain needed to prepare for the threat of “state-sponsored terrorism” by Russia or other hostile powers targeting everyday infrastructure.

NCSC’s chief executive, Richard Horne, will warn the public in a speech accompanying the review on Tuesday that AI is going to unleash a wave of cyber-attacks imminently.

“In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents,” he will say.

Horne will attribute the threat to the technology’s ability to uncover weaknesses in IT systems that have been “tolerated for far too long”.

An example of AI’s capacity to root out previously undetected vulnerabilities came last month, when the technology helped discover a critical weakness in PHP, a computer language used by almost 70% of the world’s websites.

Alan Woodward, a professor of cybersecurity at Surrey University, said NCSC’s warning underlined the need for nation states and companies to access cutting-edge AI technology.

“AI can help people find these flaws and patch them, but if we don’t get the access the bad guys will beat them to it,” he said. So far, leading AI companies like OpenAI and Anthropic have given some companies advanced access to their most powerful models in order to help them identify serious IT glitches.

Horne will also say in his speech that communications networks used by the British military are subjected to daily attacks that are “persistent” and “sustained”.

Horne will say Russia was one of the perpetrators, but the attacks have deliberately not crossed the line into warfare, with Moscow carrying out “notable campaigns” that “intentionally fall below the threshold of armed conflict as they escalate their attempts at hybrid warfare”.

Horne will add that recent cyber-attacks on supermarket fridges in Europe, which have seen fridge temperatures raised by hackers to more than 50C, are a warning to companies and organisations to invest strongly in cyber resilience.

“For decades we have collectively got away with tech on the cheap,” he will say.