UK NCSC warns of AI-enabled cyberattacks on UK critical infrastructure by 2028 from state and criminal actors
The head of the UK National Cyber Security Centre (NCSC), Richard Horne, warned that the UK will likely face AI-enabled cyberattacks on its critical infrastructure by 2028. The warning came with the publication of the NCSC annual report. Criminals and states, notably China and Russia, are expected to use AI increasingly, including AI-powered malware for ransomware attacks. The report calls Chinese activity the most sophisticated and sustained cyber challenge facing the UK. It says Russia runs campaigns deliberately below the threshold of armed conflict and that Iran targets the UK and individuals seen as threats to its regime. The NCSC assesses that AI will more likely scale and enhance existing tactics and techniques than discover brand-new vulnerabilities.
Detalhes técnicos
- Horne cited operational technology exposure: electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls.
- Recent attacks on refrigeration systems in French supermarkets were cited as an example of hostile actors exploiting civilian infrastructure.
- The UK and EU member states attribute a December 2025 attack on Poland's energy grid to Russia's FSB. Had it succeeded, 500,000 people could have lost electricity in winter.
- The article notes that AI-assisted discovery of two critical, unauthenticated-access flaws in a programming language used by about 70% of websites triggered urgent security updates the previous week. It names no CVEs.
- The NCSC puts the cost of malicious cyber activity to UK organizations at almost $20 billion per year. Jaguar Land Rover suffered more than $260 million in direct losses from a 2025 attack that also hit suppliers.
Remediação
- The NCSC urges organizations to keep devices up to date, limit administrator access to systems, and back up important files and data.
- Leaders who fail to invest in cybersecurity or replace out-of-date technology should expect to answer for the consequences.
Linha do tempo
-
UK NCSC warns of AI-enabled cyberattacks on UK critical infrastructure by 2028 from state and criminal actors
ler a análise desta fonte ocultar
The head of the UK National Cyber Security Centre (NCSC), Richard Horne, warned that the UK will likely face AI-enabled cyberattacks on its critical infrastructure by 2028. The warning came with the publication of the NCSC annual report. Criminals and states, notably China and Russia, are expected to use AI increasingly, including AI-powered malware for ransomware attacks. The report calls Chinese activity the most sophisticated and sustained cyber challenge facing the UK. It says Russia runs campaigns deliberately below the threshold of armed conflict and that Iran targets the UK and individuals seen as threats to its regime. The NCSC assesses that AI will more likely scale and enhance existing tactics and techniques than discover brand-new vulnerabilities.
Technical Details
- Horne cited operational technology exposure: electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls.
- Recent attacks on refrigeration systems in French supermarkets were cited as an example of hostile actors exploiting civilian infrastructure.
- The UK and EU member states attribute a December 2025 attack on Poland's energy grid to Russia's FSB. Had it succeeded, 500,000 people could have lost electricity in winter.
- The article notes that AI-assisted discovery of two critical, unauthenticated-access flaws in a programming language used by about 70% of websites triggered urgent security updates the previous week. It names no CVEs.
- The NCSC puts the cost of malicious cyber activity to UK organizations at almost $20 billion per year. Jaguar Land Rover suffered more than $260 million in direct losses from a 2025 attack that also hit suppliers.
Remediation
- The NCSC urges organizations to keep devices up to date, limit administrator access to systems, and back up important files and data.
- Leaders who fail to invest in cybersecurity or replace out-of-date technology should expect to answer for the consequences.