Richard Horne to warn of AI ransomware surge and daily military network strikes

The National Cyber Security Centre is preparing to tell the British public that a wave of cyber-attacks is imminent. NCSC chief executive Richard Horne will deliver a speech on Tuesday accompanying the organization's annual review. He will state that there is a real prospect of an unprecedented rise in cyber incidents in the coming months. The threat is attributed to AI's ability to uncover weaknesses in IT systems that have been tolerated for years.

The NCSC, a part of the GCHQ spy agency, predicts that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. The agency defines this infrastructure to include energy, transport, defence, food, health, and finance sectors. The warning notes that Russia and China are expected to use AI routinely in cyber-attacks. The organization describes the likelihood of such an attack as highly likely between now and 2028.

Ransomware remains a primary tool for criminal hacker groups, often operating from former Soviet Union states. Attackers gain access to IT systems, encrypt files with bespoke malicious software, and demand cryptocurrency payments to unlock systems and return data. Recent UK victims include Royal Mail, the outsourcing firm Capita, and various public bodies and councils. AI is expected to enhance this threat by assisting attackers in scouting targets, locating network weaknesses, and writing malicious code.

Horne will point to a recent discovery of a critical weakness in PHP, a computer language used by nearly 70% of the world's websites, as evidence of AI's capacity to find vulnerabilities. Alan Woodward, a cybersecurity professor at Surrey University, said the warning underlines the need for nations and companies to access advanced AI technology. He noted that leading firms like OpenAI and Anthropic have given some companies access to powerful models to help identify IT glitches, warning that without such access, bad actors will prevail.

The speech will also cover military communications networks, which Horne says are subjected to daily, persistent, and sustained attacks. He will identify Russia as a key perpetrator, noting that Moscow carries out campaigns that intentionally fall below the threshold of armed conflict while escalating hybrid warfare efforts. The NCSC will also cite recent attacks on supermarket fridges in Europe, where hackers raised temperatures to more than 50C, as a signal for companies to invest in cyber resilience.

Horne will argue that organizations have historically relied on cheap technology. He will call for stronger investment in cyber resilience to counter these evolving threats. The government recently urged citizens to stock up on nine litres of bottled water and three days of food to prepare for serious emergencies, a move linked to the threat of state-sponsored terrorism by hostile powers.

Horne will conclude his remarks by emphasizing the immediate nature of the threat. The NCSC's annual review provides the data supporting these claims, with the speech scheduled to take place this Tuesday.