NCSC Warning: AI-Powered Malware Highly Likely to Be Used in Ransomware Attack on UK Critical National Infrastructure by 2028

Key facts for TL-2026-5109

Detection coverage for TL-2026-5109

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5109 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5109 Ransomware Impact Precursors: Shadow Copy and Backup Destruction (T1486 / T1490)

Detects recovery-inhibition commands that precede or accompany ransomware encryption (T1486, T1490): vssadmin delete shadows, WMIC or PowerShell shadow copy deletion, bcdedit recovery disablement and wbadmin catalog or backup deletion. TL-2026-5109 forecasts ransomware encryption of CNI systems, including AI-powered malware, by 2028; these actions are family-agnostic and independent of how the malware was written. Row 3 of the matrix (impact; the research gives no C2 evidence).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1486, T1490
• Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 | eval cmd=lower(CommandLine) | eval inhibit=case(match(cmd,"vssadmin(.exe)? +delete +shadows"),"vssadmin_delete_shadows", match(cmd,"wmic.* shadowcopy +delete"),"wmic_shadowcopy_delete", match(cmd,"bcdedit.* (recoveryenabled +no|bootstatuspolicy +ignoreallfailures)"),"bcdedit_disable_recovery", match(cmd,"wbadmin +delete +(catalog|systemstatebackup)"),"wbadmin_delete_backup", match(cmd,"win32_shadowcopy.*delete"),"ps_shadowcopy_delete", true(),null()) | where isnotnull(inhibit) | stats count dc(inhibit) AS distinct_methods values(inhibit) AS methods values(CommandLine) AS command_lines min(_time) AS first_seen BY host, User | convert ctime(first_seen)

Microsoft KQL

DeviceProcessEvents | where Timestamp > ago(24h) | extend cmd = tolower(ProcessCommandLine) | extend InhibitMethod = case(cmd matches regex 'vssadmin(.exe)? +delete +shadows', 'vssadmin_delete_shadows', cmd matches regex 'wmic.* shadowcopy +delete', 'wmic_shadowcopy_delete', cmd matches regex 'bcdedit.* (recoveryenabled +no|bootstatuspolicy +ignoreallfailures)', 'bcdedit_disable_recovery', cmd matches regex 'wbadmin +delete +(catalog|systemstatebackup)', 'wbadmin_delete_backup', cmd matches regex 'win32_shadowcopy.*delete', 'ps_shadowcopy_delete', '') | where InhibitMethod != '' | summarize Events = count(), Methods = make_set(InhibitMethod), CommandLines = make_set(ProcessCommandLine, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName | project DeviceName, AccountName, Events, Methods, CommandLines, FirstSeen, LastSeen

Sigma

title: Ransomware Recovery Inhibition via Shadow Copy and Backup Deletion (TL-2026-5109)
id: d4a9e6b3-1c58-4b7f-8e30-6f2a9d5c8b03
status: experimental
description: Detects shadow copy, boot recovery and backup catalog deletion commands that precede or accompany ransomware encryption (T1486, T1490), the impact scenario NCSC forecasts against UK CNI.
references:
    - https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.impact
    - attack.t1486
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'bootstatuspolicy ignoreallfailures'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
    condition: 1 of selection_*
falsepositives:
    - Backup or storage administrators deliberately pruning shadow copies
    - Disk imaging or system-preparation scripts
level: high

Known false positives:

• Backup or storage administrators deliberately pruning shadow copies
• Disk imaging or system-preparation scripts run by IT

Tuning notes: Exclude approved backup service accounts and management hosts. Escalate immediately when more than one method is seen on the same host or when it follows the SPL-002 execution alert. On OT or CNI hosts without Sysmon, use Windows Security 4688 with command-line auditing enabled.

• 🔒 TL-2026-5109 KQL Exploitation Probing of Internet-Facing Legacy Web Systems (T1190 / T1595.002) · unlock with TL Creds
• 🔒 TL-2026-5109 KQL Office-Spawned Obfuscated Script Execution after Phishing (T1566 / T1027 / T1059.001) · unlock with TL Creds
• 🔒 TL-2026-5109 KQL Ransomware Impact Precursors: Shadow Copy and Backup Destruction (T1486 / T1490) · unlock with TL Creds
• 🔒 TL-2026-5109 Sigma Exploit Probing of Internet-Facing Web Systems (T1190 / T1595.002) · unlock with TL Creds
• 🔒 TL-2026-5109 Sigma Office-Spawned Obfuscated Script Execution after Phishing (T1566 / T1027 / T1059.001) · unlock with TL Creds
• 🔒 TL-2026-5109 Sigma Ransomware Impact Precursors: Shadow Copy and Backup Destruction (T1486 / T1490) · unlock with TL Creds
• 🔒 TL-2026-5109 Exploitation Probing of Internet-Facing Legacy Web Systems (T1190 / T1595.002) · unlock with TL Creds
• 🔒 TL-2026-5109 Office-Spawned Obfuscated Script Execution after Phishing (T1566 / T1027 / T1059.001) · unlock with TL Creds

Indicators of compromise for TL-2026-5109

As of 2026-11-03, Threadlinqs Intelligence tracks 6 indicators of compromise for TL-2026-5109.

How NCSC Warning works

AI adoption by hostile actors is expected to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation against long-neglected, legacy technology.

This record documents a forward-looking strategic assessment from the UK National Cyber Security Centre (NCSC), not a single campaign. In a statement published 3 November 2026, NCSC CEO Dr Richard Horne said AI-enabled cyber capabilities will be used by hostile actors to discover and exploit existing vulnerabilities in older legacy technology across UK critical national infrastructure, and that an AI-powered malware ransomware attack on UK CNI is 'highly likely' by 2028. Horne said 'for decades, we have collectively got away with doing tech on the cheap' and that vulnerabilities can now be 'discovered and exploited at a scale that was once unimaginable'.

The assessment builds on earlier NCSC reporting. The NCSC assessment 'Impact of AI on cyber threat from now to 2027' judged that AI will highly likely increase the volume and impact of cyber intrusions by enhancing existing tactics, techniques and procedures rather than creating novel threat vectors, that skilled actors will highly likely use AI-enabled automation to aid evasion and scalability, that fully automated end-to-end advanced attacks are unlikely by 2027, and that there will almost certainly be a digital divide between systems keeping pace with AI-enabled threats and a large proportion that are more vulnerable. On 4 May 2026 an NCSC blog warned organisations to prepare for an AI-driven 'vulnerability patch wave', recommending prioritisation of external-facing systems, hot patching and automated updates where available, and risk-based prioritisation with SSVC. On 17 June 2026, in the RUSI Annual Security Lecture, Horne said roughly 75% of the 200+ incidents affecting UK CNI handled by NCSC in the year to May 2026 were linked to state actors (Russia, China, Iran named), and that vulnerabilities tolerated today will be exploited in conflict tomorrow.

The sources do not name a specific threat actor, malware family, CVE, or indicator of compromise, and do not report active exploitation of this AI-enabled scenario; it is a forecast. The government response cited is GBP 60M for the first phase of the Cyber Shield, GBP 70M for the National Exposure and Real-Time Vulnerability (NERV) Centre, and a new AI Cyber Security Centre of Excellence in Manchester, alongside the Cyber Security and Resilience Bill and National Cyber Action Plan. NCSC recommends Cyber Essentials as a baseline rather than an endpoint, avoiding unnecessary internet connectivity, and investing adequately in foundational technology. Defenders should treat this as a planning-horizon assessment: reduce exposure of legacy and internet-facing assets, shorten patch cycles, and ensure continuity and rapid recovery from ransomware.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information

Initial Access

T1190 Exploit Public-Facing Application; T1566 Phishing

Resource Development

T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for NCSC Warning

Immediate actions

• Adopt Cyber Essentials as a baseline, not an endpoint
• Prioritise patching of external-facing systems and prepare for a surge of vulnerability disclosures (NCSC patch wave guidance)
• Understand threat exposure: inventory internet-connected and legacy systems

Workarounds

• Avoid unnecessary internet connectivity for operational systems

Longer-term hardening

• Invest adequately in foundational technology rather than 'tech on the cheap'
• Build stronger defences on security fundamentals proportionate to organisation size and risk
• Ensure operational continuity and rapid recovery capability from ransomware
• Adopt automated updates and hot patching where available; use SSVC for risk-based prioritisation

Affected and fixed versions

• Various — Legacy and under-maintained technology in UK critical national infrastructure
  Vulnerable versions: Long-standing unpatched or legacy systems

Timeline of NCSC Warning

• 2025-05-07 Press coverage of the NCSC assessment 'Impact of AI on cyber threat from now to 2027': AI highly likely to increase volume and impact of intrusions by enhancing existing TTPs; critical systems realistically more vulnerable by 2027.
• 2026-05-04 NCSC blog 'Preparing for a vulnerability patch wave' warns AI is accelerating flaw discovery and exploitation and urges organisations to prepare for a surge of disclosures.
• 2026-06-17 NCSC states AI-enabled cyber capabilities will likely be used by 2028 to exploit known vulnerabilities in legacy technology at scale across critical infrastructure.
• 2026-06-17 NCSC CEO locked-ioc-5's RUSI Annual Security Lecture: ~75% of 200+ CNI incidents in the year to May 2026 linked to state actors (Russia, China, Iran named).
• 2026-11-03 Government response cited: GBP 60M Cyber Shield phase one, GBP 70M NERV Centre, and an AI Cyber Security Centre of Excellence in Manchester; Cyber Essentials recommended as a baseline.
• 2026-11-03 NCSC publishes warning that locked-ioc-3 is highly likely to be used in a ransomware attack on UK CNI by 2028 and that AI-powered attacks on CNI are expected within two years.

Sources cited for NCSC Warning

• NCSC: Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years NCSC (UK) · Advisory · 2026-11-03
• NCSC: NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems NCSC (UK) · Advisory · 2026-06-17
• NCSC: UK critical systems at increased risk from 'digital divide' created by AI threats NCSC (UK) · Advisory
• NCSC: Impact of AI on cyber threat from now to 2027 NCSC (UK) · Research
• BankInfoSecurity: UK Warns of AI-Based Attacks Against Critical Infrastructure bankinfosecurity.com · News · 2025-05-07
• Security Affairs: AI speeds flaw discovery, forcing rapid updates, UK NCSC warns securityaffairs.com · News
• The Record: Britain nation-state cyberattacks, Richard Horne at RUSI The Record · News
• Computing: NCSC plans AI-powered Cyber Shield against autonomous cyberattacks computing.co.uk · News

More in threat intel

• Spamhaus Botnet Threat Update July to December 2025: C&C Activity Up 24%, RATs 42% of Top 20 Botnet Malware
• Spamhaus Botnet Spotlight: Pressure Rises on Botnets (Threat Update July-December 2025) - VenomRAT, Latrodectus, CrazyRDP Takedown
• Spamhaus Botnet Threat Update January–June 2026: Sliver Overtakes Cobalt Strike as Leading C&C Family
• Microsoft Security Research: What Exploited Vulnerabilities Have in Common - Data-Driven Analysis of Real-World Attacks
• Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys

Further reading

• Ransomware C2 Hosting Abuse: LockBit, BianLian