UK says AI-powered ransomware attack on critical infrastructure is highly likely by 2028

UK cyber watchdog warns AI attacks on critical infrastructure could arrive by 2028

The UK's National Cyber Security Centre (NCSC) has said it is "highly likely" that AI-powered malware will be used in a ransomware attack on the country's critical national infrastructure (CNI) by 2028. CNI is the set of systems and services a country depends on to function, such as power, water, transport and healthcare.

The warning appears in the NCSC's Annual Review 2026, published on Nov 3. The report says artificial intelligence will make ransomware campaigns, social engineering attacks and the finding of security weaknesses larger and more efficient.

Key numbers and claims

• The NCSC judges it "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure between now and 2028.


• AI is expected to raise the scale and speed of ransomware operations, social engineering and vulnerability exploitation.


• China, Russia and other nation-states are expected to use AI-based cyber tools to push their geopolitical goals.


• Spear-phishing against high-risk individuals, including politicians and government officials, has continued during the year, with more attempts to compromise messaging apps.

What the NCSC report says

The report links the cyber threat picture to the UK's economic and national security. It argues that state-backed hackers will increasingly use AI tools to target government officials, politicians and other high-risk people.

"Technology has always influenced cyber security. What is different today is the pace. The ability of state actors to harness new technologies will increasingly determine their effectiveness," the NCSC said in the review.

What other sources add

The NCSC review does not name a specific new AI tool. It builds on recent warnings from other agencies. In March, Dutch intelligence said Russian state hackers were targeting officials, military staff and civil servants around the world, including by pretending to be Signal support to take over accounts.

What is confirmed

• The NCSC Annual Review 2026 exists and was published on Nov 3, 2026.


• The NCSC stated it is highly likely AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028.


• The NCSC flagged continued spear-phishing against high-risk people and more attempts to break into messaging applications.


• Dutch intelligence has reported Russian state hackers impersonating Signal support to hijack accounts.

What is still unclear

• The report does not name a specific attacker or a specific AI tool used so far.


• The report gives no detail on how often AI was used in attacks so far this year.


• The NCSC did not give a step-by-step timetable for what happens before 2028.

Why this matters

Ransomware locks data and systems until a payment is made, so an AI-boosted attack could spread faster and cost more to fix. If critical services such as energy, water or transport are hit, everyday life and the economy could be affected. The warning about AI tools being used to target government and political figures also points to a growing mix of crime and state-level espionage.

Where this was reported

• Cointelegraph - "UK warns AI ransomware attack on infrastructure by 2028," written by Felix Ng and edited by Yohan Yun, Nov 3, 2026