UK infrastructure at risk: AI-powered cyberattacks expected by 2028

The NCSC, a division of the GCHQ, highlighted in its annual review that Russia and China are anticipated to increasingly incorporate AI into their cyberattack strategies. The agency stated, “It is … highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI.”

Ransomware attacks, often originating from former Soviet Union states, involve encrypting a victim’s data and demanding cryptocurrency payments for its release. Previous victims in the UK include Royal Mail, Capita, and various local councils.

The NCSC believes AI will amplify the ransomware threat by aiding attackers in identifying targets, exploiting vulnerabilities, and generating malicious code.

Recently, the government advised citizens to prepare for potential emergencies by stockpiling up to nine liters of water and three days’ worth of food, citing threats like state-sponsored terrorism.

NCSC chief executive Richard Horne will publicly warn of a surge in cyber incidents in an upcoming speech. He attributes this risk to AI’s ability to expose previously overlooked weaknesses in IT systems. An example occurred last month when AI identified a critical flaw in PHP, a language powering approximately 70% of global websites.

Cybersecurity expert Alan Woodward emphasized the importance of both nations and companies gaining access to advanced AI technology to counter these threats. He stated, “AI can help people find these flaws and patch them, but if we don’t get the access the bad guys will beat them to it.”

Horne will also reveal that British military communications networks face daily, sustained cyberattacks, some attributed to Russia. These attacks, while escalating, have not yet triggered armed conflict, representing a form of hybrid warfare. Recent incidents, such as hackers manipulating fridge temperatures in European supermarkets to over 50C, serve as a warning for organizations to strengthen their cyber defenses. Horne will conclude, “For decades we have collectively got away with tech on the cheap.”, urging greater investment in cyber resilience.