AI-Driven Malware Predicted to Threaten UK Infrastructure by 2028

The National Cyber Security Centre (NCSC) has issued a stark warning that artificial intelligence (AI) driven malware is expected to play a significant role in hacking attempts against critical infrastructures in the UK, such as power plants, airports, and hospitals, by the year 2028. This warning is part of the NCSC’s annual review, highlighting the rapidly changing landscape of cyber threats.

According to the NCSC, advancements in AI could facilitate ransomware attacks targeting the UK’s critical national infrastructure (CNI). This infrastructure encompasses a variety of services ranging from energy and transportation to defense, food security, healthcare, and financial systems. The body emphasized that there is a high likelihood of AI-enabled ransomware incidents occurring within this timeframe.

The report also cautions that nations like Russia and China are expected to utilize AI in their cyber warfare strategies, making such technologies a routine element in cyber attacks. “It is… highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI,” stated the NCSC.

Ransomware has emerged as a critical tool among cybercriminals, particularly those operating from regions that were once part of the Soviet Union. After breaching a victim’s IT infrastructure, these perpetrators encrypt sensitive data using customized malware and subsequently demand a ransom, typically in cryptocurrency, to regain access to compromised files. Notable victims of such attacks in the UK have included the Royal Mail and major outsourcing firm Capita, alongside numerous public entities.

The NCSC highlighted that AI technologies could heighten ransomware threats by streamlining processes such as target reconnaissance, identifying vulnerabilities in IT networks, and generating malicious code. Last month, the UK government requested that citizens prepare for possible emergencies, including cyber events, by stocking essential supplies like food and water as part of their Be Ready campaign.

In a forthcoming address, NCSC chief executive Richard Horne plans to underscore the urgency regarding AI’s impact on cybersecurity, implying an imminent surge in cyber incidents. He is poised to articulate that the forthcoming months could usher in an unprecedented wave of cyber threats, attributing this to AI’s capacity to uncover long-standing vulnerabilities in digital infrastructures.

A recent instance illustrating AI’s potential to expose hidden flaws was its role in identifying a critical weakness in the PHP programming language, which is utilized by nearly 70% of the internet’s websites. Experts like Alan Woodward, a cybersecurity professor at Surrey University, stress the urgency for nations and companies to adopt cutting-edge AI technologies, as failing to do so could leave them vulnerable to more sophisticated attacks.

Horne will also note that communications frameworks employed by the British military face persistent cyber threats, often attributed to Russian actors. These attacks have strategically remained below the threshold of armed conflict, reflecting a broader strategy of hybrid warfare.

Moreover, Horne will cite recent cyber incidents affecting supermarket refrigeration units across Europe, which saw temperatures manipulated to dangerously high levels, as a strong indication that organizations must invest significantly in cyber resilience.

“For decades, we have collectively relied on budget solutions for technology,” he remarked, emphasizing the need for a shift in how businesses approach cybersecurity.