UK infrastructure faces AI-powered ransomware attacks by 2028

The looming threat to infrastructure

The National Cyber Security Centre (NCSC), a state cybersecurity body under the GCHQ spy agency, has issued a stark warning regarding the future of digital safety. According to the organization's annual review, there is a high probability that hackers will employ automated software to strike the UK’s critical national infrastructure (CNI) by 2028.

The term CNI refers to a wide range of essential facilities and services that keep a country running. This includes vital sectors such as energy, transport, defense, food, health, and finance. The NCSC specifically highlighted that power stations, airports, and hospitals are at high risk of being targeted by these new types of attacks.

Ransomware has already become a primary tool for criminal hackers, particularly those operating out of former Soviet Union states. In these attacks, criminals gain access to a victim's IT systems and use bespoke malware to encrypt files, demanding a cryptocurrency payment to unlock the data and restore the crippled systems. Notable victims of these attacks in the UK have included the outsourcing firm Capita, Royal Mail, and various local councils.

How AI scales cybercrime

Artificial intelligence is expected to significantly enhance the capabilities of ransomware gangs by automating several complex stages of a cyberattack. The NCSC notes that AI will help attackers scout for potential targets and locate specific weaknesses within IT networks. Furthermore, the technology can be used to write the malicious code required to execute these attacks more efficiently.

One of the most significant risks involves the ability of AI to uncover vulnerabilities that have been tolerated for far too long. For instance, the technology recently helped identify a major flaw in PHP, a programming language that powers nearly 70% of all websites on the internet. This demonstrates how quickly AI can root out previously undetected flaws in common software.

Because AI can process data and identify patterns at high speeds, it allows bad actors to strike with greater precision. The NCSC warns that Russia and China are expected to start using AI routinely in cyber-attacks. This shift suggests that the volume and sophistication of incidents could rise imminently as these tools become more accessible to hostile powers.

The defense and the arms race

Cybersecurity experts argue that the rise of AI-powered threats creates a necessary arms race between defenders and attackers. Alan Woodward, a professor of cybersecurity at Surrey University, noted that nation states and companies must access cutting-edge AI technology to stay ahead. He explained that while AI can help people find and patch flaws, the "bad guys will beat them to it" if access is not secured.

To counter these threats, leading AI companies like OpenAI and Anthropic have already begun providing some organizations with early access to their most powerful models. These tools are specifically intended to help companies identify and fix serious IT glitches before they can be exploited. This collaborative approach highlights the dual nature of the technology as both a weapon and a shield.

The NCSC's chief executive, Richard Horne, will emphasize that the technology is poised to trigger an immediate surge in cyber incidents. He attributes this risk to the speed at which AI can find flaws in systems that have remained unpatched for years. The goal for the public and private sectors is to move away from a history of using technology cheaply and instead invest in robust resilience.

Geopolitics and military risks

The threat landscape is not limited to criminal gangs; it also involves state-sponsored activity. Horne noted that communications networks used by the British military are currently under constant pressure, facing daily attacks that are both persistent and sustained. While Russia has been identified as a perpetrator in some of these instances, the activity has intentionally avoided crossing into full-scale warfare.

Moscow has been observed carrying out notable campaigns that stay just below the threshold of armed conflict. This strategy is part of an escalation in hybrid warfare, where cyber actions are used to exert influence without triggering a traditional military response. The NCSC warns that these tactics are becoming more sophisticated as AI integration increases among hostile powers.

Recent incidents in Europe provide a tangible example of these risks, where hackers successfully manipulated supermarket refrigeration systems. By raising temperatures to over 50C, these attackers demonstrated how cyber-attacks can have immediate physical consequences for commerce and food safety. Such events serve as a warning that infrastructure resilience must be a top priority for organizations worldwide.

Preparing for the worst

In response to these growing risks, the UK government has begun urging citizens to prepare for various types of emergencies. Last month, the government advised residents to maintain a supply of nine litres of bottled water and enough food to last for three days. This advice is intended to ensure that households can remain safe during weather events, cyber-attacks, or other serious national emergencies.

Defense Secretary Wes Streeting has linked these preparations to the broader threat of state-sponsored terrorism from hostile powers. He stated that Britain must be ready for attacks targeting everyday infrastructure that people rely on daily. The