The UK’s National Cyber Security Centre (NCSC) says artificial intelligence will likely make ransomware attacks larger and more efficient, warning that AI-powered malware is “highly likely” to be used in a ransomware attack on UK critical national infrastructure (CNI) by 2028.
The assessment appears in the NCSC’s Annual Review 2026, where the agency ties advances in AI to broader cyber risk across the country’s economic and national security interests.
Key takeaways
- The NCSC projects that AI-powered malware will be used in ransomware attacks on UK critical national infrastructure by 2028.
- The report links AI to improved ransomware scale and efficiency, including social engineering and vulnerability exploitation.
- The NCSC also warns that nation-states—including China and Russia—may leverage “AI cyber” to pursue geopolitical aims faster.
- State-backed espionage risk is rising, with the NCSC pointing to spear-phishing and increased attempts to compromise messaging applications.
Why the NCSC’s AI ransomware warning matters
While ransomware has been a persistent threat for years, the NCSC’s focus on AI-powered malware underscores a shift from conventional automation toward more adaptable malicious tools. In the NCSC’s framing, AI can raise both the operational effectiveness and the reach of ransomware campaigns.
In particular, the Annual Review 2026 says AI will increase the scale and efficiency of ransomware operations, including how attackers carry out social engineering—the tactics used to trick people into acting—and how they conduct vulnerability exploitation, where attackers target weaknesses in software or systems.
Crucially for CNI operators, the NCSC does not present this as a remote possibility. It states: “It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI.” That phrasing suggests the agency views the evolution as likely within a near-term planning window rather than a longer, speculative horizon.
“AI cyber” and the geopolitical dimension
The ransomware warning sits within a wider threat assessment that connects cyber risk to UK economic and national security. The NCSC also warns that China, Russia and other nation-states are expected to use “AI cyber” as part of their geopolitical playbooks.
The agency’s logic is about speed and effectiveness: as AI capabilities improve, the ability of state actors to incorporate new tools into cyber operations becomes a decisive factor. The NCSC also cautions that these developments could increase both the scale and pace of cyber threats aimed at the UK.
For investors, operators, and security teams, the key implication is that defensive planning can’t assume adversaries will keep using familiar tactics at the same intensity. If AI increases throughput—more attempts, faster adaptation, better targeting—then incident prevention and response need to account for a higher operational tempo.
Espionage threats: spear-phishing and messaging app compromises
Beyond ransomware, the NCSC highlights a continuing risk of state-backed cyber espionage, with targeting focused on politicians, government officials and other high-risk individuals.
In its review of the year, the NCSC observed persistent spear-phishing activity against high-risk individuals and reported an increase in efforts to compromise messaging applications. These developments matter because spear-phishing can provide an initial foothold—credentials, access, or malware delivery—while messaging-app compromise can enable attackers to maintain control, hide activity, or manipulate communications.
The NCSC’s messaging-app concern aligns with earlier reporting from European intelligence authorities. In March, Dutch intelligence agencies warned that Russian state hackers were targeting officials, military personnel and civil servants worldwide. According to the Dutch agencies, attackers impersonated Signal support in an effort to hijack accounts. The NCSC references that concern as part of its broader assessment of how cyber operations are targeting high-value people.
What the NCSC says is changing—its “pace” argument
In the Annual Review 2026, the NCSC emphasizes that cyber security has always been shaped by technology, but it argues something has changed in recent years: the pace.
The agency wrote: “Technology has always influenced cyber security. What is different today is the pace. The ability of state actors to harness new technologies will increasingly determine their effectiveness.”
This point is more than rhetoric. If attackers can iterate faster and tailor methods more effectively, then defenders face a moving target: security improvements must be matched not only to known threats, but also to rapid adaptation. In practical terms, that means incident response readiness, identity and access protections, and training that addresses phishing and social engineering remain central—especially for organizations tied to CNI responsibilities.
As AI becomes more integrated into both offensive and defensive tooling, the most important watch-outs are likely to be the operational signals: increased frequency of social-engineering attempts, more convincing impersonation, and broader use of AI-assisted exploitation in campaigns that test defenses.
Looking ahead, organizations responsible for critical services and government-linked functions should treat the NCSC’s timeline as a planning prompt rather than a prediction to ignore. The next key developments to monitor are whether AI-enabled ransomware campaigns begin to show measurable changes in targeting patterns against UK CNI, and whether messaging-app compromise attempts continue to escalate alongside spear-phishing efforts.
