UK Cyber Agency Warns AI Ransomware Attack on Critical Infrastructure Is “Highly Likely” by 2028
by Maisie Morrison · BlockonomiTLDR
Table of Contents
- The UK’s National Cyber Security Centre says AI-powered malware will highly likely be used in a ransomware attack on critical national infrastructure by 2028.
- The warning appears in the NCSC’s Annual Review 2026.
- The agency says China, Russia and other nation-states will use “AI cyber” to pursue geopolitical goals.
- State-backed hackers are targeting politicians, government officials and other high-risk individuals.
- Dutch intelligence warned in March that Russian hackers impersonated Signal support to hijack accounts.
The UK’s National Cyber Security Centre (NCSC) has warned that AI-powered malware will likely be used in a ransomware attack on the country’s critical national infrastructure by 2028. The warning appears in the agency’s Annual Review 2026.
The NCSC is part of GCHQ, the UK’s intelligence, security and cyber agency. Its annual review sets out the main cyber threats facing the country over the past year and the years ahead.
In the report, the agency said artificial intelligence will increase the scale and efficiency of ransomware operations. It also said AI will boost social engineering and the exploitation of software vulnerabilities.
“It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI,” the report states. CNI stands for critical national infrastructure.
Critical national infrastructure covers the systems a country depends on to function every day. In the UK, this includes sectors such as energy, water, transport, health and telecommunications.
Ransomware is a type of malicious software that locks or encrypts a victim’s files and systems. Attackers then demand a payment, often in cryptocurrency, to restore access.
State Hackers Expected to Use “AI Cyber”
The ransomware warning forms part of a broader assessment in the annual review. The NCSC linked cyber threats directly to the UK’s economic and national security.
The agency said China, Russia and other nation-states will use “AI cyber” to achieve their geopolitical goals. According to the report, this will increase both the scale and the speed of cyber threats facing the UK.
The NCSC did not limit its concerns to criminal ransomware groups. The report also pointed to foreign governments adopting new technology to strengthen their cyber operations.
Politicians and Officials Targeted
Beyond ransomware, the NCSC highlighted the growing threat of state-backed cyber espionage. The targets include politicians, government officials and other high-risk individuals.
During the year, the agency observed persistent spear-phishing activity against these individuals. Spear-phishing uses tailored emails or messages designed to trick a specific person into handing over access or information.
The NCSC also reported increasing efforts by attackers to compromise messaging applications. Messaging apps can hold private conversations, contact lists and shared files.
Similar warnings have come from other countries this year. In March, Dutch intelligence agencies said Russian state hackers were targeting officials, military personnel and civil servants around the world.
In that campaign, attackers impersonated Signal support staff to hijack user accounts. Signal is an encrypted messaging app that lets users send private messages and make calls.
The NCSC said the ability of state actors to harness new technologies will increasingly determine how effective they are. “Technology has always influenced cyber security. What is different today is the pace,” the agency said.