UK NCSC warns AI-powered ransomware is likely to hit UK critical infrastructure by 2028 in State of the Cyber Nation report
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 04/11/2026 00:08; os links antigos trazem para cá.
Fontes: infosecurity-magazine.com ↗ theregister.com ↗ securityweek.com ↗
The UK National Cyber Security Centre (NCSC) published its annual State of the Cyber Nation report on 3 November 2026. In it, CEO Richard Horne warned that AI-enabled attacks, including AI-powered malware used in ransomware, are likely to reach UK critical national infrastructure such as power stations, airports and hospitals by 2028 (securityweek.com, infosecurity-magazine.com, theregister.com). The NCSC assesses that AI will mostly scale and enhance existing tactics rather than discover brand-new vulnerabilities. Horne says the real problem is long-tolerated weaknesses, such as under-investment, end-of-life systems and weak access controls, that AI makes discoverable and exploitable at unprecedented scale (infosecurity-magazine.com). The report names China as the most sophisticated and sustained cyber challenge to the UK. It says Russia operates deliberately below the threshold of armed conflict and that Iran targets the UK and people it sees as threats to its regime (securityweek.com). The government paired the warning with a package of funding and programmes (infosecurity-magazine.com).
Detalhes técnicos
- The NCSC highlighted abuse of open-source AI tools originally built for security research. It cited ARTEX, a Chinese-made AI red-teaming platform, as misused since July in attacks against 123 Reg, Microsoft 365 and other targets (theregister.com). Only this source mentions ARTEX.
- The report's pessimistic scenario has wider attacker adoption of AI tools raising attack frequency and sophistication and complicating attribution. China is "likely" to supply such tools to obscure state or criminal activity. The NCSC also raised the theoretical risk of autonomous, self-replicating attack agents operating beyond human control (theregister.com).
- Horne cited exposed operational technology: electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls (securityweek.com). Recent attacks on refrigeration systems in French supermarkets were given as an example of hostile actors exploiting civilian infrastructure (securityweek.com). Bridewell CEO Anthony Young pointed to the same attacks as evidence that attackers already exploit basic weaknesses at scale, and called the two-year timeline "generous" (infosecurity-magazine.com).
- The UK and EU member states attribute a December 2025 attack on Poland's energy grid to Russia's FSB. Had it succeeded, 500,000 people could have lost electricity in winter (securityweek.com).
- As a recent example of AI-accelerated flaw discovery, Horne highlighted the PHP2Shell vulnerabilities, with 110,000 proactive notifications and Early Warning alerts sent to UK organizations (infosecurity-magazine.com). Another outlet describes AI-assisted discovery of two critical, unauthenticated-access flaws in a programming language used by about 70% of websites, which triggered urgent security updates the previous week, and names no CVEs (securityweek.com). The two outlets do not explicitly tie these descriptions together, and no CVE identifiers are given.
- The NCSC puts the cost of malicious cyber activity to UK organizations at almost $20 billion per year. Jaguar Land Rover suffered more than $260 million in direct losses from a 2025 attack that also hit suppliers (securityweek.com).
Remediação
- The NCSC urges organizations to keep devices up to date, limit administrator access to systems, and back up important files and data. Leaders who fail to invest in cybersecurity or replace out-of-date technology should expect to answer for the consequences (securityweek.com).
- Government measures announced (infosecurity-magazine.com):
- A national Cyber Shield initiative, reported as £60m, with a £25m Challenge Fund and a new National Exposure and Real-Time Vulnerability (NERV) Centre reported at £70m.
- A further £120m for the AI Security Institute (AISI).
- A new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC.
- £40m for a National Agentic Security Unit.
- £24m to strengthen public-sector AI-based cyber defenses.
- A 75% discount on Cyber Essentials certification for micro, small and medium businesses.
- 14 Software Security Ambassadors, including Fortinet, Thales, Capgemini and Zscaler, to promote secure software development.
Relatos divergentes
- Likelihood wording: One outlet says the UK will "likely" face AI-enabled attacks on critical infrastructure by 2028 (securityweek.com). Two others say AI-powered malware is "highly likely" to feature in ransomware attacks against critical national infrastructure by 2028 (infosecurity-magazine.com, theregister.com). The "highly likely" wording is the more specific and is repeated by two outlets, but none of them publishes the report text.
- Funding figures: infosecurity-magazine.com reports the Cyber Shield at £60m while listing components (£25m Challenge Fund, £70m NERV Centre) that add up to more than that total. The figures are unreconciled, so treat them with caution until the government publishes the breakdown.
- Vulnerability naming: infosecurity-magazine.com names PHP2Shell, while securityweek.com gives only a description with no name or CVEs.
Linha do tempo
-
NCSC Warns AI-Powered Ransomware Likely to Hit UK Critical Infrastructure by 2028
ler a análise desta fonte ocultar
The UK National Cyber Security Centre (NCSC) published its annual State of the Cyber Nation report, warning that AI-powered malware is highly likely to be used in ransomware attacks against UK critical national infrastructure—power stations, airports and hospitals—by 2028. NCSC CEO Richard Horne said the threat stems not from AI inventing new attack methods but from long-tolerated vulnerabilities now being discoverable and exploitable at unprecedented scale, citing poor investment, end-of-life systems, and weak access controls as root causes. He highlighted the PHP2Shell vulnerabilities as a recent example, noting 110,000 proactive notifications and Early Warning alerts issued to UK organizations. The report also warns that nation-state actors including Russia and China will increasingly use AI to pursue geopolitical goals via cyber operations.
Remediation
The UK government announced £60m for a national Cyber Shield initiative (including a £25m Challenge Fund and £70m for a new National Exposure and Real-Time Vulnerability (NERV) Centre), an additional £120m for the AI Security Institute (AISI), a new AI Cyber Security Centre of Excellence in Manchester run by NCSC, £40m for a National Agentic Security Unit, and £24m to strengthen public-sector AI-based cyber defenses. A 75% discount on Cyber Essentials certification was announced for micro, small and medium businesses, and 14 Software Security Ambassadors (including Fortinet, Thales, Capgemini and Zscaler) were named to promote secure software development. Bridewell CEO Anthony Young called the two-year warning timeline "generous," pointing to recent attacks on supermarket refrigeration systems as evidence attackers are already exploiting basic weaknesses at scale.
-
NCSC Warns AI-Powered Ransomware Could Hit UK Critical Infrastructure by 2028
ler a análise desta fonte ocultar
The UK's National Cyber Security Centre (NCSC) published its annual review alongside a forward-looking assessment warning that AI-powered malware is "highly likely" to feature in a future ransomware attack against Britain's critical national infrastructure by 2028. The agency highlighted abuse of open-source AI tools originally built for security research, citing ARTEX, a Chinese-made AI red-teaming platform, as already being misused in attacks against 123 Reg, Microsoft 365, and other targets since July. The report's pessimistic scenario envisions wider adoption of AI tools by attackers increasing attack frequency and sophistication while complicating attribution, with China "likely" supplying such tools to obscure state or criminal activity. The NCSC also raised the theoretical risk of autonomous, self-replicating attack agents operating beyond human control.
-
UK NCSC warns of AI-enabled cyberattacks on UK critical infrastructure by 2028 from state and criminal actors
ler a análise desta fonte ocultar
The head of the UK National Cyber Security Centre (NCSC), Richard Horne, warned that the UK will likely face AI-enabled cyberattacks on its critical infrastructure by 2028. The warning came with the publication of the NCSC annual report. Criminals and states, notably China and Russia, are expected to use AI increasingly, including AI-powered malware for ransomware attacks. The report calls Chinese activity the most sophisticated and sustained cyber challenge facing the UK. It says Russia runs campaigns deliberately below the threshold of armed conflict and that Iran targets the UK and individuals seen as threats to its regime. The NCSC assesses that AI will more likely scale and enhance existing tactics and techniques than discover brand-new vulnerabilities.
Technical Details
- Horne cited operational technology exposure: electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls.
- Recent attacks on refrigeration systems in French supermarkets were cited as an example of hostile actors exploiting civilian infrastructure.
- The UK and EU member states attribute a December 2025 attack on Poland's energy grid to Russia's FSB. Had it succeeded, 500,000 people could have lost electricity in winter.
- The article notes that AI-assisted discovery of two critical, unauthenticated-access flaws in a programming language used by about 70% of websites triggered urgent security updates the previous week. It names no CVEs.
- The NCSC puts the cost of malicious cyber activity to UK organizations at almost $20 billion per year. Jaguar Land Rover suffered more than $260 million in direct losses from a 2025 attack that also hit suppliers.
Remediation
- The NCSC urges organizations to keep devices up to date, limit administrator access to systems, and back up important files and data.
- Leaders who fail to invest in cybersecurity or replace out-of-date technology should expect to answer for the consequences.