The UK’s National Cyber Security Centre warned in its Annual Review 2026 that AI-powered malware is highly likely to be used in a ransomware attack on UK critical national infrastructure by 2028. This is a forecast, not a report of an attack that has occurred. The NCSC said AI would increase the scale and efficiency of ransomware operations, social engineering and vulnerability exploitation.
The NCSC also warned that China, Russia and other states would use AI in cyber operations, and said it had observed persistent spear-phishing against high-risk individuals and growing efforts to compromise messaging apps.
