UK's NCSC warns AI-powered malware likely to hit critical infrastructure by 2028

The UK's National Cyber Security Centre (NCSC), part of the GCHQ intelligence agency, has warned that AI-powered malware is highly likely to be used against the country's critical national infrastructure by 2028, according to a news report on its annual review. In the NCSC's assessment, AI will probably make possible a ransomware attack on such infrastructure within that window. The UK definition of critical national infrastructure spans energy, transport, defence, food, health and finance, and the report names power stations, airports and hospitals as potential targets. The review also warns that Russia and China will begin using AI routinely in cyber-attacks.

The article explains that ransomware involves attackers locking a victim's files with custom malware and demanding cryptocurrency payment, and it lists Royal Mail, Capita and various councils among UK victims. The NCSC expects AI to make the threat worse by helping attackers scout targets, find weaknesses in networks and write malicious code. NCSC chief executive Richard Horne is due to say in a speech that cyber incidents could climb to an unprecedented level in the coming months, because AI can surface IT weaknesses that were put up with for far too long. As an example, the report notes AI helped uncover a critical flaw in PHP, a language used by almost 70% of websites.

Horne is also expected to say that British military communications networks face persistent daily attacks, with Russia among those responsible, and that recent hacks raising temperatures in European supermarket fridges above 50C show the need for resilience. Alan Woodward of Surrey University said states and companies need access to leading AI, so defenders can fix flaws before attackers exploit them.