AI’s ransomware clock is ticking: UK CNI faces a “highly likely” threat by 2028

The UK National Cyber Security Centre (NCSC) has warned that AI-powered malware is “highly likely” to be used in a ransomware attack on UK critical national infrastructure (CNI) between now and 2028.

In its Annual Review 2026, the NCSC said artificial intelligence will increase the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation. “It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI,” the report states.

The assessment also covers cyber threats linked to the UK’s economic and national security. The NCSC warned that China, Russia and other nation-states will use “AI cyber” to achieve their geopolitical goals, increasing the scale and speed of cyber threats facing the UK.

State-backed cyber espionage remains a growing threat, with the NCSC highlighting targeting of politicians, government officials and other high-risk individuals. During the year, it observed persistent spear-phishing activity against high-risk individuals and increasing efforts to compromise messaging applications.

In March, Dutch intelligence agencies warned that Russian state hackers were targeting officials, military personnel and civil servants worldwide. Attackers impersonated Signal support to hijack accounts. “Technology has always influenced cyber security. What is different today is the pace. The ability of state actors to harness new technologies will increasingly determine their effectiveness,” said the NCSC.