SecOraLens
CriticalRansomware

AI-Powered Ransomware Is Coming for UK Critical Infrastructure, and Europe Is Already the Testing Ground

Cyble·Source published ·1 min read

What happened?

Overview The UK's National Cyber Security Centre (NCSC) has put a date on a threat that security teams across Europe have been bracing for. In its 2026 Annual Review, The State of the Cyber Nation, the agency assesses it is highly likely that AI-powered malware will be used in a ransomware attack on UK Critical National Infrastructure by 2028. That is not a distant, speculative scenario. It is a two-year window, and it lands alongside a second judgement.

Key details

  • NCSC assesses AI-powered ransomware will highly likely hit UK critical infrastructure by 2028.
  • UK and EU attributed December 2025 attack on Poland's energy grid to Russia's FSB Centre 16.
  • NCSC rates China as most sophisticated and sustained cyber challenge facing the UK.
  • 88% of incidents for large organizations began through four initial access vectors.
  • UK government research puts annual cost of malicious cyber activity at about £14.7 billion.

Affected

  • UK Critical National Infrastructure targeted by 2028.
  • Poland's energy grid attacked in December 2025.
  • Organizations with legacy technology and slow remediation.

Fixes and mitigations

  1. Harden edge by inventorying and patching internet-facing applications, VPNs, routers and remote access services.
  2. Segment IT from OT and monitor boundaries continuously.
  3. Govern AI use internally by mapping data access, actions and monitoring; close shadow AI with approved alternatives.
  4. Rehearse ransomware recovery playbooks against scenarios where operational systems must run during disruption.
  5. Use threat intelligence that moves at AI speed to monitor newly disclosed flaws and stolen credentials.

What to look for

  • Exploitation of vulnerable routers by FSB Centre 16 targeting CNI networks worldwide.
  • Attacks on programmable logic controllers (PLCs) as evidence of OT targeting.
  • Shadow AI: staff moving sensitive data to personal devices for unsanctioned AI tools.

Summarised by SecOraLens from Cyble. Always read the original source before acting. How SecOraLens verifies advisories.

Back to all advisories