UK warns AI ransomware attacks likely by 2028 as defenses expand

The UK's National Cyber Security Centre (NCSC) has issued a stark warning that artificial intelligence-powered malware is "highly likely" to feature in ransomware attacks targeting Britain's critical national infrastructure between now and 2028. This forecast accompanies the agency's annual review and a separate assessment examining how AI could reshape cyber threats over the next two years.

While the cyber arm of signals intelligence agency GCHQ provided limited detail on the specific form these AI tools might take, it highlighted concerns that open source AI security tools intended for researchers are being repurposed by attackers.

• Researchers have increasingly observed widespread abuse of ARTEX, a Chinese-made open source AI red-teaming platform launched in July.
• This tool has been exploited in attacks on UK registrar 123 Reg, Microsoft 365, and others.

In a pessimistic scenario for 2028, the NCSC envisions "a significant increase in the frequency and sophistication of cyberattacks worldwide," noting that wider AI adoption will make attribution significantly harder. The report states China "has likely played a role" in supplying these tools, enabling adversaries to hide their activities within the noise report.

A further threat identified by the NCSC is an autonomous attacker operating beyond its human operator's control. The agency describes this as a "realistic possibility" where such an entity could self-replicate and conduct cyberattacks at will, with no apparent motivation or restraint. Such attacks would likely complicate geopolitical relationships due to attribution difficulties, making it easier for countries ordering attacks on others to deny their involvement.

The UK's plans for AI defense

Acknowledging that each Patch Tuesday now brings record numbers of bugs record numbers, the NCSC is actively exploring how AI can help defenders keep pace. Project DROMOS, launched earlier this year with a four-week pilot analyzing government code repositories before expanding to operational environments, has uncovered hundreds of potential security issues including critical vulnerabilities.

The Government Cyber Coordination Centre (GC3) initiated the project in collaboration with the AI Security Institute and other departments. The review also reaffirms plans for Cyber Shield, an agentic cyber defense system first teased in July that is expected to be delivered in stages over the next five years.

Key elements of the government's AI defense strategy include:

• Cyber Shield: An initiative where the NCSC provides defensive agents deployed by participating organizations with data designed to strengthen national resilience against ongoing threats, running alongside the Department for Digital, Culture, Media and Sport (DCMS).
• Funding: The government has set aside £60 million to fund the Cyber Shield initiative and an additional £70 million for a new National Exposure and Real-Time Vulnerability (NERV) Centre.
• NERV Centre: This body will identify and maintain an ongoing understanding of vulnerabilities across critical national infrastructure organizations and the wider economy.
• National Agentic Security Unit: Funded with £40 million to respond to uncontrolled bots and other agentic mishaps.
• Public Sector Defenses: £24 million allocated to strengthen defenses within the public sector.
• New Centre in Manchester: An undisclosed sum will establish an NCSC-managed AI Cyber Security Centre to develop AI security expertise across government.

NCSC CEO Dr Richard Horne is calling for organizations to "invest with urgency" in their security and resilience, criticizing decades of doing tech on the cheap. He urged leaders to treat the NCSC's Cyber Essentials certification as a starting point but scale up efforts based on organizational size, complexity, and risk. The government also announced a 75 percent discount on Cyber Essentials certification for micro, small, and medium-sized businesses applying for their first certificate discount.