UK NCSC warns AI-powered ransomware is likely to hit UK critical infrastructure by 2028 in State of the Cyber Nation report
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 05/11/2026 00:12; os links antigos trazem para cá.
Fontes: industrialcyber.co ↗ digit.fyi ↗ infosecurity-magazine.com ↗ theregister.com ↗ securityweek.com ↗
The UK National Cyber Security Centre (NCSC), part of GCHQ, published its annual State of the Cyber Nation report, also titled Annual Review 2026, on 3 November 2026. The review marks ten years since the NCSC's founding (digit.fyi, industrialcyber.co). CEO Richard Horne warned that AI-enabled attacks, including AI-powered malware used in ransomware, are likely to reach UK critical national infrastructure such as power stations, airports and hospitals by 2028 (securityweek.com, infosecurity-magazine.com, theregister.com). Two further outlets say the NCSC assesses it as "highly likely" that AI-powered malware will be used in a ransomware attack on UK CNI by 2028 (industrialcyber.co, digit.fyi). The NCSC assesses that AI will mostly scale and enhance existing tactics rather than discover brand-new vulnerabilities. Horne says the real problem is long-tolerated weaknesses, such as under-investment, end-of-life systems and weak access controls, that AI makes discoverable and exploitable at unprecedented scale (infosecurity-magazine.com). The report names China as the most sophisticated and sustained cyber challenge to the UK and the actor with the most intent and capability to use AI against CNI (securityweek.com, digit.fyi). It says Russia operates deliberately below the threshold of armed conflict and is the most audacious threat, and that Iran targets the UK and people it sees as threats to its regime, with Iran-linked groups causing indiscriminate disruption (securityweek.com, industrialcyber.co). The government paired the warning with a package of funding and programmes (infosecurity-magazine.com).
Detalhes técnicos
- The NCSC highlighted abuse of open-source AI tools originally built for security research. It cited ARTEX, a Chinese-made AI red-teaming platform, as misused since July in attacks against 123 Reg, Microsoft 365 and other targets (theregister.com). Only this source mentions ARTEX.
- The report's pessimistic scenario has wider attacker adoption of AI tools raising attack frequency and sophistication and complicating attribution. China is "likely" to supply such tools to obscure state or criminal activity. The NCSC also raised the theoretical risk of autonomous, self-replicating attack agents operating beyond human control (theregister.com).
- 88% of incidents affecting large organizations stem from four initial access vectors: exploitation of public-facing applications, phishing, misuse of valid accounts, and exploitation of external remote services (digit.fyi, industrialcyber.co). Most successful compromises still exploit known vulnerabilities in internet-facing systems, stolen credentials and social engineering. Several state-linked incidents exploited vulnerabilities for which patches existed but were not deployed in time (industrialcyber.co).
- Incident statistics: the NCSC Incident Management team received 1,831 cyber attack reports this year. 337 required support and 80 were nationally significant. The Early Warning service notified 8,500 organizations of suspected compromise (industrialcyber.co).
- Based on analysis of the 337 incidents, the NCSC drew seven lessons (digit.fyi):
- Attackers keep exploiting known vulnerabilities on poorly secured systems.
- Social engineering and credential theft remain effective.
- State and criminal actors exploit similar weaknesses.
- Ransomware remains highly disruptive (extortion, data theft, operational disruption, long recovery).
- Preparation (logging, monitoring, incident response planning, supply chain resilience) determines outcomes.
- Early detection and containment reduce impact.
- Initial access does not require sophistication, though later attack stages often do.
- The report notes growing "cyber-attack as a service" offerings that lower the barrier for threat actors. It warns of AI-assisted vulnerability discovery and shadow AI as emerging risks (digit.fyi).
- The report identifies four trends: China's whole-of-state cyber approach and data-harvesting ambitions; cyber operations as a tool of state power; economic security's dependence on cyber security; and accelerating technology change via AI (industrialcyber.co).
- Horne cited exposed operational technology: electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls (securityweek.com). Recent attacks on refrigeration systems in French supermarkets were given as an example of hostile actors exploiting civilian infrastructure (securityweek.com). Recent attacks on programmable logic controllers (PLCs) were cited as evidence that organizations failing to modernize are becoming easier targets (industrialcyber.co). Bridewell CEO Anthony Young pointed to the same attacks as evidence that attackers already exploit basic weaknesses at scale, and called the two-year timeline "generous" (infosecurity-magazine.com).
- The UK and EU member states attribute a December 2025 attack on Poland's energy grid to Russia's FSB. Had it succeeded, 500,000 people could have lost electricity in winter (securityweek.com, industrialcyber.co).
- The report also references the FSB Centre 16 campaign, disclosed in July 2026 with 18 partners, which exploits vulnerable routers to target critical infrastructure worldwide (industrialcyber.co).
- The UK sanctioned China-based firms i-Soon and Integrity Technology Group in December 2025, and 24 individuals and entities linked to Russian destructive operations (industrialcyber.co).
- Government launched Project DROMOS, a joint NCSC-DCMS/AI Security Institute initiative using frontier AI models to accelerate vulnerability discovery in government codebases. It has uncovered hundreds of potential issues, including critical vulnerabilities (industrialcyber.co).
- As a recent example of AI-accelerated flaw discovery, Horne highlighted the PHP2Shell vulnerabilities, with 110,000 proactive notifications and Early Warning alerts sent to UK organizations (infosecurity-magazine.com). Another outlet describes AI-assisted discovery of two critical, unauthenticated-access flaws in a programming language used by about 70% of websites, which triggered urgent security updates the previous week, and names no CVEs (securityweek.com). The outlets do not explicitly tie these descriptions together, and no CVE identifiers are given.
- The NCSC puts the cost of malicious cyber activity to UK organizations at almost $20 billion per year (securityweek.com), or £14.7 billion annually (digit.fyi). Jaguar Land Rover suffered more than $260 million in direct losses from a 2025 attack that also hit suppliers (securityweek.com). The 2025 attack is also cited as costing about £196 million and denting UK GDP growth (industrialcyber.co).
Remediação
- The NCSC urges organizations to keep devices up to date, limit administrator access to systems, and back up important files and data. Leaders who fail to invest in cybersecurity or replace out-of-date technology should expect to answer for the consequences (securityweek.com).
- The NCSC recommends focusing on cyber resilience fundamentals: patching known vulnerabilities, improving security culture against social engineering, strengthening logging, monitoring and incident response, and building supply chain resilience (digit.fyi).
- Horne called for urgent investment in foundational cybersecurity, reduced unnecessary internet exposure, adoption of passkeys over passwords, and Cyber Essentials as a baseline rather than an end goal (industrialcyber.co). The source text is truncated at this point.
- Government measures announced (infosecurity-magazine.com):
- A national Cyber Shield initiative, reported as £60m, with a £25m Challenge Fund and a new National Exposure and Real-Time Vulnerability (NERV) Centre reported at £70m.
- A further £120m for the AI Security Institute (AISI).
- A new AI Cyber Security Centre of Excellence in Manchester, run by the NCSC.
- £40m for a National Agentic Security Unit.
- £24m to strengthen public-sector AI-based cyber defenses.
- A 75% discount on Cyber Essentials certification for micro, small and medium businesses.
- 14 Software Security Ambassadors, including Fortinet, Thales, Capgemini and Zscaler, to promote secure software development.
Relatos divergentes
- Likelihood wording: One outlet says the UK will "likely" face AI-enabled attacks on critical infrastructure by 2028 (securityweek.com). Four others say AI-powered malware is "highly likely" to be used in ransomware attacks against critical national infrastructure by 2028 (infosecurity-magazine.com, theregister.com, industrialcyber.co, digit.fyi). The "highly likely" wording is the more specific and is now repeated by four outlets, but none of them publishes the report text.
- Funding figures: infosecurity-magazine.com reports the Cyber Shield at £60m while listing components (£25m Challenge Fund, £70m NERV Centre) that add up to more than that total. The figures are unreconciled, so treat them with caution until the government publishes the breakdown.
- Vulnerability naming: infosecurity-magazine.com names PHP2Shell, while securityweek.com gives only a description with no name or CVEs.
- Annual cost of malicious activity: securityweek.com reports almost $20 billion per year, while digit.fyi reports £14.7 billion annually. These may be the same estimate in different currencies, but no source says so. The sterling figure appears to come directly from the review, and digit.fyi is the more specific.
- Jaguar Land Rover loss: securityweek.com reports more than $260 million in direct losses, while industrialcyber.co reports about £196 million. The currencies and scope (direct losses versus total cost) are not reconciled.
- Notification numbers: infosecurity-magazine.com cites 110,000 proactive notifications and Early Warning alerts tied to PHP2Shell. industrialcyber.co says the Early Warning service notified 8,500 organizations of suspected compromise over the year. The two figures measure different things and are not directly comparable.
Linha do tempo
-
NCSC Annual Review 2026: UK warns AI-powered malware likely to hit critical infrastructure ransomware attack by 2028
ler a análise desta fonte ocultar
The UK National Cyber Security Centre (NCSC), part of GCHQ, published its Annual Review 2026 (State of the Cyber Nation report) on Nov. 3, assessing it as highly likely that hostile actors will increasingly use AI to scale ransomware, social engineering and vulnerability exploitation over the next two years, with AI-powered malware highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. The report stresses that AI does not create new attack methods but accelerates discovery and exploitation of long-tolerated vulnerabilities, with 88% of incidents at large organizations stemming from four initial access vectors: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting external remote services. It identifies four trends shaping the threat landscape: China's whole-of-state cyber approach and data-harvesting ambitions, the use of cyber operations as a tool of state power (with Russia as the most audacious threat and Iran-linked groups causing indiscriminate disruption), economic security's dependence on cyber security (citing the 2025 Jaguar Land Rover attack costing ~£196 million and denting UK GDP growth), and accelerating technology change via AI. NCSC CEO Richard Horne called for urgent investment in foundational cybersecurity, reduced unnecessary internet exposure, and adoption of Cyber Essentials as a baseline rather than an end goal.
Technical Details
The NCSC Incident Management team received 1,831 cyber attack reports this year; 337 required support and 80 were nationally significant, while the Early Warning service notified 8,500 organizations of suspected compromise. Most successful compromises still exploit known vulnerabilities in internet-facing systems, stolen credentials and social engineering; several state-linked incidents exploited vulnerabilities for which patches existed but were not deployed in time. Recent attacks on programmable logic controllers (PLCs) were cited as evidence that organizations failing to modernize are becoming easier targets. The report also references the FSB Centre 16 campaign (disclosed July 2026 with 18 partners) exploiting vulnerable routers to target critical infrastructure worldwide, and an attributed December 2025 attack on Poland's energy grid that could have cut power to 500,000 citizens. The UK sanctioned China-based firms i-Soon and Integrity Technology Group in December 2025, and 24 individuals/entities linked to Russian destructive operations. Government launched Project DROMOS, a joint NCSC-DCMS/AI Security Institute initiative using frontier AI models to accelerate vulnerability discovery in government codebases, uncovering hundreds of potential issues including critical vulnerabilities.
Remediation
The NCSC urges organizations to invest in foundational cybersecurity, minimize unnecessary internet-facing connectivity, adopt passkeys over passwords, treat Cyber Essentials as a starting point, strengthen supply chain resilience via the Cyber Resilience Pledge, and prioritize patching of known CVEs to shorten exposure windows ahead of AI-accelerated exploit development.
-
NCSC 2026 Annual Review: AI Accelerates Known Threats, China and Ransomware Top UK Risks
ler a análise desta fonte ocultar
The National Cyber Security Centre (NCSC) published its 2026 Annual Review marking ten years since its founding, concluding that the cyber threat landscape has evolved in scale and speed rather than in fundamental nature. The review states that 88% of incidents affecting large organisations stem from four initial access vectors: exploitation of public-facing applications, phishing, misuse of valid accounts, and exploitation of external remote services. AI is highlighted as a force multiplier enabling threat actors to operate at greater scale and speed, with China singled out as having the most intent and capability to use AI against UK critical national infrastructure (CNI). The NCSC estimates malicious cyber activity costs UK organisations £14.7 billion annually, and warns it is "highly likely" that AI-assisted malware will be used in a ransomware attack against UK CNI.
Technical Details
Based on analysis of 337 incidents over the past year, the NCSC drew seven key lessons: attackers continue to exploit known vulnerabilities on poorly secured systems; social engineering and credential theft remain effective; state and criminal actors exploit similar weaknesses; ransomware remains highly disruptive (extortion, data theft, operational disruption, long recovery times); preparation (logging, monitoring, incident response planning, supply chain resilience) determines outcomes; early detection and containment reduce impact; and initial access does not require sophistication, though later attack stages often do. The report also notes growing "cyber-attack as a service" offerings lowering the barrier for threat actors, and warns of AI-assisted vulnerability discovery and shadow AI as emerging risks.
Remediation
The NCSC recommends organisations focus on cyber resilience fundamentals — patching known vulnerabilities, improving security culture to counter social engineering, strengthening logging/monitoring and incident response capabilities, and building supply chain resilience — as the most effective way to reduce both likelihood and impact of incidents.
-
NCSC Warns AI-Powered Ransomware Likely to Hit UK Critical Infrastructure by 2028
ler a análise desta fonte ocultar
The UK National Cyber Security Centre (NCSC) published its annual State of the Cyber Nation report, warning that AI-powered malware is highly likely to be used in ransomware attacks against UK critical national infrastructure—power stations, airports and hospitals—by 2028. NCSC CEO Richard Horne said the threat stems not from AI inventing new attack methods but from long-tolerated vulnerabilities now being discoverable and exploitable at unprecedented scale, citing poor investment, end-of-life systems, and weak access controls as root causes. He highlighted the PHP2Shell vulnerabilities as a recent example, noting 110,000 proactive notifications and Early Warning alerts issued to UK organizations. The report also warns that nation-state actors including Russia and China will increasingly use AI to pursue geopolitical goals via cyber operations.
Remediation
The UK government announced £60m for a national Cyber Shield initiative (including a £25m Challenge Fund and £70m for a new National Exposure and Real-Time Vulnerability (NERV) Centre), an additional £120m for the AI Security Institute (AISI), a new AI Cyber Security Centre of Excellence in Manchester run by NCSC, £40m for a National Agentic Security Unit, and £24m to strengthen public-sector AI-based cyber defenses. A 75% discount on Cyber Essentials certification was announced for micro, small and medium businesses, and 14 Software Security Ambassadors (including Fortinet, Thales, Capgemini and Zscaler) were named to promote secure software development. Bridewell CEO Anthony Young called the two-year warning timeline "generous," pointing to recent attacks on supermarket refrigeration systems as evidence attackers are already exploiting basic weaknesses at scale.
-
NCSC Warns AI-Powered Ransomware Could Hit UK Critical Infrastructure by 2028
ler a análise desta fonte ocultar
The UK's National Cyber Security Centre (NCSC) published its annual review alongside a forward-looking assessment warning that AI-powered malware is "highly likely" to feature in a future ransomware attack against Britain's critical national infrastructure by 2028. The agency highlighted abuse of open-source AI tools originally built for security research, citing ARTEX, a Chinese-made AI red-teaming platform, as already being misused in attacks against 123 Reg, Microsoft 365, and other targets since July. The report's pessimistic scenario envisions wider adoption of AI tools by attackers increasing attack frequency and sophistication while complicating attribution, with China "likely" supplying such tools to obscure state or criminal activity. The NCSC also raised the theoretical risk of autonomous, self-replicating attack agents operating beyond human control.
-
UK NCSC warns of AI-enabled cyberattacks on UK critical infrastructure by 2028 from state and criminal actors
ler a análise desta fonte ocultar
The head of the UK National Cyber Security Centre (NCSC), Richard Horne, warned that the UK will likely face AI-enabled cyberattacks on its critical infrastructure by 2028. The warning came with the publication of the NCSC annual report. Criminals and states, notably China and Russia, are expected to use AI increasingly, including AI-powered malware for ransomware attacks. The report calls Chinese activity the most sophisticated and sustained cyber challenge facing the UK. It says Russia runs campaigns deliberately below the threshold of armed conflict and that Iran targets the UK and individuals seen as threats to its regime. The NCSC assesses that AI will more likely scale and enhance existing tactics and techniques than discover brand-new vulnerabilities.
Technical Details
- Horne cited operational technology exposure: electricity switching, water facility sluice gates, dam operations, manufacturing lines, and heating and refrigeration controls.
- Recent attacks on refrigeration systems in French supermarkets were cited as an example of hostile actors exploiting civilian infrastructure.
- The UK and EU member states attribute a December 2025 attack on Poland's energy grid to Russia's FSB. Had it succeeded, 500,000 people could have lost electricity in winter.
- The article notes that AI-assisted discovery of two critical, unauthenticated-access flaws in a programming language used by about 70% of websites triggered urgent security updates the previous week. It names no CVEs.
- The NCSC puts the cost of malicious cyber activity to UK organizations at almost $20 billion per year. Jaguar Land Rover suffered more than $260 million in direct losses from a 2025 attack that also hit suppliers.
Remediation
- The NCSC urges organizations to keep devices up to date, limit administrator access to systems, and back up important files and data.
- Leaders who fail to invest in cybersecurity or replace out-of-date technology should expect to answer for the consequences.