UK Cyber Agency Warns AI-Powered Malware Will Target Infrastructure by 2028
The UK's National Cyber Security Centre warns that AI-powered ransomware attacks against critical national infrastructure are highly likely by 2028, urging stronger defensive measures.
The UK’s National Cyber Security Centre (NCSC) has issued a stark warning in its annual review, stating that AI-powered malware is "highly likely" to be deployed in ransomware attacks against critical national infrastructure (CNI) by 2028. The cybersecurity authority, which operates as part of the GCHQ spy agency, highlighted that artificial intelligence will significantly lower the barrier for sophisticated cyber-attacks aimed at essential services across the country.
Escalating threats to critical infrastructure
The scope of critical national infrastructure in the UK spans several key sectors, including energy, transport, defence, health, food, and finance. Facilities such as power stations, airports, and hospitals are among the potential targets facing increased risk. The NCSC expects hostile state actors, specifically Russia and China, to start using AI "routinely" in their cyber operations, while criminal ransomware gangs—frequently operating out of former Soviet Union states—will leverage the technology to refine their tactics.
Ransomware attacks typically involve unauthorized entry into an organization's network, encrypting files using custom malware, and demanding cryptocurrency payments to restore access and prevent data exposure. Previous high-profile UK victims of ransomware include Royal Mail, outsourcing firm Capita, and several public bodies including local councils. Furthermore, the British military’s communication networks face daily, persistent cyber operations from adversaries such as Russia, conducting campaigns that intentionally remain below the threshold of armed conflict.
The threat extends beyond government agencies to civilian infrastructure. In Europe, recent cyber-attacks targeted supermarket refrigeration systems, remotely driving temperatures above 50 degrees Celsius. These developments coincide with the UK government's recent "Be Ready" campaign, which advised citizens to store nine liters of bottled water and three days’ worth of food for emergency situations. Defence Secretary Wes Streeting cautioned that the nation must prepare for potential state-sponsored terrorism targeting daily infrastructure.
How AI changes offensive and defensive security
According to the NCSC, AI enhances the capabilities of malicious actors by simplifying labor-intensive tasks. AI models can assist hackers in scouting potential targets, mapping out IT network vulnerabilities, and writing malicious code. NCSC Chief Executive Richard Horne warned that the technology exposes long-standing security flaws in IT environments, stating, "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents." Horne noted that for decades, organizations have "collectively got away with tech on the cheap," leaving systems vulnerable.
The dual-use nature of AI in cybersecurity was recently demonstrated when automated tools identified a critical vulnerability in PHP, a computer language powering roughly 70 percent of global websites. While attackers can use AI to exploit such flaws, defensive teams rely on the same technology to uncover and fix bugs before breaches occur. Alan Woodward, a professor of cybersecurity at Surrey University, emphasized that "AI can help people find these flaws and patch them, but if we don’t get the access the bad guys will beat them to it." Major AI providers, including OpenAI and Anthropic, have already granted select organizations early access to advanced models specifically to aid in vulnerability identification.
What it means for developers
For software engineers and system architects, the NCSC's warning underscores an urgent need to re-evaluate code security and infrastructure resilience. As automated tools make it easier for malicious actors to discover zero-day bugs in widely used software stacks—such as the recent PHP vulnerability—developers can no longer rely on obscurity or delayed patching cycles.
Integrating AI into defensive workflows is becoming essential for modern engineering teams. AI tools can analyze codebases, automate static analysis, and simulate potential attack vectors to harden applications prior to deployment. To support automated vulnerability scanning and code auditing, developers can try top AI models cheaply through one API at https://apixoai.online. Using advanced models allows teams to perform thorough security inspections and identify system glitches efficiently.
Ultimately, developers must shift from reactive patching to proactive security design. As Richard Horne highlighted, legacy vulnerabilities that were previously tolerated are now immediate targets for automated exploitation. By prioritizing security in everyday development and leveraging AI-driven defensive tools, software engineers can help protect both commercial applications and critical infrastructure against upcoming AI-driven threats.
Source: AI-powered malware ‘highly likely’ to be used to hack UK infrastructure by 2028 — The Guardian AI. Written by the Apixo team from that report.
One key for Claude, GPT, GLM, DeepSeek and more. Pay per token with crypto.
Get your API key
