NCSC Annual Review 2026: UK warns AI-powered malware likely to hit critical infrastructure ransomware attack by 2028
The UK National Cyber Security Centre (NCSC), part of GCHQ, published its Annual Review 2026 (State of the Cyber Nation report) on Nov. 3, assessing it as highly likely that hostile actors will increasingly use AI to scale ransomware, social engineering and vulnerability exploitation over the next two years, with AI-powered malware highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. The report stresses that AI does not create new attack methods but accelerates discovery and exploitation of long-tolerated vulnerabilities, with 88% of incidents at large organizations stemming from four initial access vectors: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting external remote services. It identifies four trends shaping the threat landscape: China's whole-of-state cyber approach and data-harvesting ambitions, the use of cyber operations as a tool of state power (with Russia as the most audacious threat and Iran-linked groups causing indiscriminate disruption), economic security's dependence on cyber security (citing the 2025 Jaguar Land Rover attack costing ~£196 million and denting UK GDP growth), and accelerating technology change via AI. NCSC CEO Richard Horne called for urgent investment in foundational cybersecurity, reduced unnecessary internet exposure, and adoption of Cyber Essentials as a baseline rather than an end goal.
Detalhes técnicos
The NCSC Incident Management team received 1,831 cyber attack reports this year; 337 required support and 80 were nationally significant, while the Early Warning service notified 8,500 organizations of suspected compromise. Most successful compromises still exploit known vulnerabilities in internet-facing systems, stolen credentials and social engineering; several state-linked incidents exploited vulnerabilities for which patches existed but were not deployed in time. Recent attacks on programmable logic controllers (PLCs) were cited as evidence that organizations failing to modernize are becoming easier targets. The report also references the FSB Centre 16 campaign (disclosed July 2026 with 18 partners) exploiting vulnerable routers to target critical infrastructure worldwide, and an attributed December 2025 attack on Poland's energy grid that could have cut power to 500,000 citizens. The UK sanctioned China-based firms i-Soon and Integrity Technology Group in December 2025, and 24 individuals/entities linked to Russian destructive operations. Government launched Project DROMOS, a joint NCSC-DCMS/AI Security Institute initiative using frontier AI models to accelerate vulnerability discovery in government codebases, uncovering hundreds of potential issues including critical vulnerabilities.
Remediação
The NCSC urges organizations to invest in foundational cybersecurity, minimize unnecessary internet-facing connectivity, adopt passkeys over passwords, treat Cyber Essentials as a starting point, strengthen supply chain resilience via the Cyber Resilience Pledge, and prioritize patching of known CVEs to shorten exposure windows ahead of AI-accelerated exploit development.
Linha do tempo
-
NCSC Annual Review 2026: UK warns AI-powered malware likely to hit critical infrastructure ransomware attack by 2028
ler a análise desta fonte ocultar
The UK National Cyber Security Centre (NCSC), part of GCHQ, published its Annual Review 2026 (State of the Cyber Nation report) on Nov. 3, assessing it as highly likely that hostile actors will increasingly use AI to scale ransomware, social engineering and vulnerability exploitation over the next two years, with AI-powered malware highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. The report stresses that AI does not create new attack methods but accelerates discovery and exploitation of long-tolerated vulnerabilities, with 88% of incidents at large organizations stemming from four initial access vectors: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting external remote services. It identifies four trends shaping the threat landscape: China's whole-of-state cyber approach and data-harvesting ambitions, the use of cyber operations as a tool of state power (with Russia as the most audacious threat and Iran-linked groups causing indiscriminate disruption), economic security's dependence on cyber security (citing the 2025 Jaguar Land Rover attack costing ~£196 million and denting UK GDP growth), and accelerating technology change via AI. NCSC CEO Richard Horne called for urgent investment in foundational cybersecurity, reduced unnecessary internet exposure, and adoption of Cyber Essentials as a baseline rather than an end goal.
Technical Details
The NCSC Incident Management team received 1,831 cyber attack reports this year; 337 required support and 80 were nationally significant, while the Early Warning service notified 8,500 organizations of suspected compromise. Most successful compromises still exploit known vulnerabilities in internet-facing systems, stolen credentials and social engineering; several state-linked incidents exploited vulnerabilities for which patches existed but were not deployed in time. Recent attacks on programmable logic controllers (PLCs) were cited as evidence that organizations failing to modernize are becoming easier targets. The report also references the FSB Centre 16 campaign (disclosed July 2026 with 18 partners) exploiting vulnerable routers to target critical infrastructure worldwide, and an attributed December 2025 attack on Poland's energy grid that could have cut power to 500,000 citizens. The UK sanctioned China-based firms i-Soon and Integrity Technology Group in December 2025, and 24 individuals/entities linked to Russian destructive operations. Government launched Project DROMOS, a joint NCSC-DCMS/AI Security Institute initiative using frontier AI models to accelerate vulnerability discovery in government codebases, uncovering hundreds of potential issues including critical vulnerabilities.
Remediation
The NCSC urges organizations to invest in foundational cybersecurity, minimize unnecessary internet-facing connectivity, adopt passkeys over passwords, treat Cyber Essentials as a starting point, strengthen supply chain resilience via the Cyber Resilience Pledge, and prioritize patching of known CVEs to shorten exposure windows ahead of AI-accelerated exploit development.