UK Cyber Agency Warns AI Ransomware Could Hit Critical Infrastructure by 2028

The UK’s National Cyber Security Centre (NCSC) has warned that AI-powered malware is highly likely to be used in a ransomware attack on British critical national infrastructure by 2028. The assessment, published on 3 November, is a warning about where the threat is heading, not a report of an attack that has already taken place.

In its 2026 annual review, the agency says criminals are likely to use AI to make ransomware operations, social engineering and vulnerability exploitation faster and cheaper. It expects some open-source tools built for legitimate security research to be repurposed to automate attackers’ existing work. That could allow more attempts against organisations with weaker defences, even if the underlying methods are familiar.

Critical national infrastructure includes the systems and services on which everyday life depends. The NCSC’s point is not that AI has suddenly invented a new category of cyberattack. Rather, automation could help attackers identify openings, develop malicious code and conduct operations at a scale that stretches defenders. The agency’s separate assessment of AI and cyber intrusion also considers how AI may affect attacks on older technology and systems that adopt AI themselves.

The review says China is best positioned to use advanced AI capabilities in operations against critical infrastructure and other strategic targets. That is a distinct state-threat assessment. The ransomware forecast concerns the broader criminal use of AI and should not be read as attributing a future ransomware attack to China.

The NCSC also flags the risks of so-called shadow AI, when staff move sensitive work to personal devices or unapproved AI services. This can leave an organisation with less visibility over where its data goes, who can reach it and whether security procedures are being followed.

Alongside the warning, the NCSC has outlined Cyber Shield, an initiative intended to develop an agentic cyber defence ecosystem. The agency says defenders need better ways to share insight and coordinate action across government, industry and academia. It plans to work with the Department for Culture, Media and Sport on a foundational platform and challenges that test where AI agents could genuinely improve defensive speed and reach.

That ambition is not the same as an operational national shield already in place. The NCSC acknowledges that technical and policy obstacles remain before autonomous defensive systems can work at national scale. The immediate message for organisations is less futuristic: know which systems are exposed, keep vulnerable software updated, control access to sensitive data and plan how essential services would continue through an incident.

The implications extend beyond Britain. Attackers can reuse techniques across borders, while hospitals, utilities, transport providers and public agencies in many countries rely on a mixture of legacy systems and newer connected services. TechBooky has previously examined official confirmation of AI-assisted cyberattacks against Taiwanese government systems. The NCSC’s forecast adds another reason to treat resilience as a practical requirement today, rather than waiting for the first high-profile AI-assisted ransomware incident.