UK’s NCSC Warns AI-Powered Ransomware Attack on Critical Infrastructure “Highly Likely” by 2028
Key Takeaways
- •The UK's NCSC assesses that AI-powered malware is highly likely to be used in a ransomware attack against British critical national infrastructure by 2028.
- •The NCSC's Annual Review 2026 concludes that artificial intelligence will raise the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation.
- •The review warns that China, Russia and other nation-states will leverage AI cyber capabilities to advance geopolitical goals and increase the speed and scale of threats facing the UK.
- •Critical national infrastructure covers essential systems such as energy, water, transport, healthcare, finance and telecommunications, placing potential attacks within an economic and national security framework.
- •The NCSC observed persistent spear-phishing against high-risk individuals over the past year, while Dutch intelligence agencies reported in March that Russian hackers impersonated Signal support staff to hijack officials' messaging accounts.
The United Kingdom's National Cyber Security Centre (NCSC) has warned that artificial intelligence-powered malware is highly likely to be used in a ransomware attack against the country's critical national infrastructure (CNI) by 2028.
The assessment appears in the NCSC's Annual Review 2026, which concluded that AI will increase the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation.
“It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI,” the report states.
The warning forms part of a broader assessment linking cyber threats to the UK's economic and national security. The review also warns that China, Russia and other nation-states will use “AI cyber” to pursue their geopolitical goals, increasing the scale and speed of the cyber threats facing the UK.
“Technology has always influenced cyber security. What is different today is the pace. The ability of state actors to harness new technologies will increasingly determine their effectiveness,” the NCSC said.
Critical national infrastructure spans the systems society relies on daily, including energy, water, transport, healthcare, finance and telecommunications networks. That reliance on everyday services places CNI attacks directly within the review's economic and national security framing. Ransomware attacks typically encrypt an organisation's systems or data, with attackers demanding payment — often in cryptocurrency — in exchange for restoration.
Beyond ransomware, the agency highlighted the growing threat of state-backed cyber espionage targeting politicians, government officials and other high-risk individuals. Over the past year, the NCSC observed persistent spear-phishing activity against high-risk individuals, alongside increasing efforts to compromise messaging applications.
In March, Dutch intelligence agencies warned that Russian state hackers were targeting officials, military personnel and civil servants worldwide, with attackers impersonating Signal support staff to hijack accounts on the encrypted messaging app.
The projection runs to 2028, and future editions of the NCSC's annual review are the natural place to track whether AI-enabled ransomware reaches UK CNI within that window.
Related: AI poses greater threat to Bitcoin than quantum computing, Swan founder says
