# NCSC Warning: AI-Powered Malware Highly Likely to Be Used in Ransomware Attack on UK Critical National Infrastructure by 2028

> On 3 November 2026 NCSC CEO Dr Richard Horne warned that the UK faces AI-powered attacks on critical national infrastructure within two years, and that AI-powered malware is highly likely to feature in a ransomware attack on UK CNI by 2028. AI adoption by hostile actors is expected to increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation against long-neglected, legacy technology.

- **Published:** 2026-11-03T00:22:58Z
- **Last reviewed:** 2026-11-03T00:22:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5109
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5109.png
- **ID:** TL-2026-5109
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 6

## Description

This record documents a forward-looking strategic assessment from the UK National Cyber Security Centre (NCSC), not a single campaign. In a statement published 3 November 2026, NCSC CEO Dr Richard Horne said AI-enabled cyber capabilities will be used by hostile actors to discover and exploit existing vulnerabilities in older legacy technology across UK critical national infrastructure, and that an AI-powered malware ransomware attack on UK CNI is 'highly likely' by 2028. Horne said 'for decades, we have collectively got away with doing tech on the cheap' and that vulnerabilities can now be 'discovered and exploited at a scale that was once unimaginable'.

The assessment builds on earlier NCSC reporting. The NCSC assessment 'Impact of AI on cyber threat from now to 2027' judged that AI will highly likely increase the volume and impact of cyber intrusions by enhancing existing tactics, techniques and procedures rather than creating novel threat vectors, that skilled actors will highly likely use AI-enabled automation to aid evasion and scalability, that fully automated end-to-end advanced attacks are unlikely by 2027, and that there will almost certainly be a digital divide between systems keeping pace with AI-enabled threats and a large proportion that are more vulnerable. On 4 May 2026 an NCSC blog warned organisations to prepare for an AI-driven 'vulnerability patch wave', recommending prioritisation of external-facing systems, hot patching and automated updates where available, and risk-based prioritisation with SSVC. On 17 June 2026, in the RUSI Annual Security Lecture, Horne said roughly 75% of the 200+ incidents affecting UK CNI handled by NCSC in the year to May 2026 were linked to state actors (Russia, China, Iran named), and that vulnerabilities tolerated today will be exploited in conflict tomorrow.

The sources do not name a specific threat actor, malware family, CVE, or indicator of compromise, and do not report active exploitation of this AI-enabled scenario; it is a forecast. The government response cited is GBP 60M for the first phase of the Cyber Shield, GBP 70M for the National Exposure and Real-Time Vulnerability (NERV) Centre, and a new AI Cyber Security Centre of Excellence in Manchester, alongside the Cyber Security and Resilience Bill and National Cyber Action Plan. NCSC recommends Cyber Essentials as a baseline rather than an endpoint, avoiding unnecessary internet connectivity, and investing adequately in foundational technology. Defenders should treat this as a planning-horizon assessment: reduce exposure of legacy and internet-facing assets, shorten patch cycles, and ensure continuity and rapid recovery from ransomware.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1027 Obfuscated Files or Information

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5109 Ransomware Impact Precursors: Shadow Copy and Backup Destruction (T1486 / T1490)** (`TL-2026-5109-SPL-003`)

Detects recovery-inhibition commands that precede or accompany ransomware encryption (T1486, T1490): vssadmin delete shadows, WMIC or PowerShell shadow copy deletion, bcdedit recovery disablement and wbadmin catalog or backup deletion. TL-2026-5109 forecasts ransomware encryption of CNI systems, including AI-powered malware, by 2028; these actions are family-agnostic and independent of how the malware was written. Row 3 of the matrix (impact; the research gives no C2 evidence).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1486, T1490
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 | eval cmd=lower(CommandLine) | eval inhibit=case(match(cmd,"vssadmin(.exe)? +delete +shadows"),"vssadmin_delete_shadows", match(cmd,"wmic.* shadowcopy +delete"),"wmic_shadowcopy_delete", match(cmd,"bcdedit.* (recoveryenabled +no|bootstatuspolicy +ignoreallfailures)"),"bcdedit_disable_recovery", match(cmd,"wbadmin +delete +(catalog|systemstatebackup)"),"wbadmin_delete_backup", match(cmd,"win32_shadowcopy.*delete"),"ps_shadowcopy_delete", true(),null()) | where isnotnull(inhibit) | stats count dc(inhibit) AS distinct_methods values(inhibit) AS methods values(CommandLine) AS command_lines min(_time) AS first_seen BY host, User | convert ctime(first_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents | where Timestamp > ago(24h) | extend cmd = tolower(ProcessCommandLine) | extend InhibitMethod = case(cmd matches regex 'vssadmin(.exe)? +delete +shadows', 'vssadmin_delete_shadows', cmd matches regex 'wmic.* shadowcopy +delete', 'wmic_shadowcopy_delete', cmd matches regex 'bcdedit.* (recoveryenabled +no|bootstatuspolicy +ignoreallfailures)', 'bcdedit_disable_recovery', cmd matches regex 'wbadmin +delete +(catalog|systemstatebackup)', 'wbadmin_delete_backup', cmd matches regex 'win32_shadowcopy.*delete', 'ps_shadowcopy_delete', '') | where InhibitMethod != '' | summarize Events = count(), Methods = make_set(InhibitMethod), CommandLines = make_set(ProcessCommandLine, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName | project DeviceName, AccountName, Events, Methods, CommandLines, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Ransomware Recovery Inhibition via Shadow Copy and Backup Deletion (TL-2026-5109)
id: d4a9e6b3-1c58-4b7f-8e30-6f2a9d5c8b03
status: experimental
description: Detects shadow copy, boot recovery and backup catalog deletion commands that precede or accompany ransomware encryption (T1486, T1490), the impact scenario NCSC forecasts against UK CNI.
references:
    - https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.impact
    - attack.t1486
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'bootstatuspolicy ignoreallfailures'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
    condition: 1 of selection_*
falsepositives:
    - Backup or storage administrators deliberately pruning shadow copies
    - Disk imaging or system-preparation scripts
level: high
```

**Known false positives:**

- Backup or storage administrators deliberately pruning shadow copies
- Disk imaging or system-preparation scripts run by IT

**Tuning notes:** Exclude approved backup service accounts and management hosts. Escalate immediately when more than one method is seen on the same host or when it follows the SPL-002 execution alert. On OT or CNI hosts without Sysmon, use Windows Security 4688 with command-line auditing enabled.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5109 KQL Exploitation Probing of Internet-Facing Legacy Web Systems (T1190 / T1595.002) (locked: unlock with TL Creds)
- TL-2026-5109 KQL Office-Spawned Obfuscated Script Execution after Phishing (T1566 / T1027 / T1059.001) (locked: unlock with TL Creds)
- TL-2026-5109 KQL Ransomware Impact Precursors: Shadow Copy and Backup Destruction (T1486 / T1490) (locked: unlock with TL Creds)
- TL-2026-5109 Sigma Exploit Probing of Internet-Facing Web Systems (T1190 / T1595.002) (locked: unlock with TL Creds)
- TL-2026-5109 Sigma Office-Spawned Obfuscated Script Execution after Phishing (T1566 / T1027 / T1059.001) (locked: unlock with TL Creds)
- TL-2026-5109 Sigma Ransomware Impact Precursors: Shadow Copy and Backup Destruction (T1486 / T1490) (locked: unlock with TL Creds)
- TL-2026-5109 Exploitation Probing of Internet-Facing Legacy Web Systems (T1190 / T1595.002) (locked: unlock with TL Creds)
- TL-2026-5109 Office-Spawned Obfuscated Script Execution after Phishing (T1566 / T1027 / T1059.001) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [NCSC: Cyber chief: UK facing AI-powered attacks on critical infrastructure within two years](https://www.ncsc.gov.uk/news/cyber-chief-uk-facing-ai-powered-attacks-on-critical-infrastructure-in-two-years)
- [NCSC: NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems](https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks)
- [NCSC: Impact of AI on cyber threat from now to 2027](https://www.ncsc.gov.uk/report/impact-ai-cyber-threat-now-2027)
- [NCSC: UK critical systems at increased risk from 'digital divide' created by AI threats](https://www.ncsc.gov.uk/news/ai-to-2027-threat-assessment)
- [BankInfoSecurity: UK Warns of AI-Based Attacks Against Critical Infrastructure](https://www.bankinfosecurity.com/uk-warns-ai-based-attacks-against-critical-infrastructure-a-28341)
- [Security Affairs: AI speeds flaw discovery, forcing rapid updates, UK NCSC warns](https://securityaffairs.com/191657/security/ai-speeds-flaw-discovery-forcing-rapid-updates-uk-ncsc-warns.html)
- [The Record: Britain nation-state cyberattacks, Richard Horne at RUSI](https://therecord.media/britain-nation-state-cyberattacks-richard-horne-rusi)
- [Computing: NCSC plans AI-powered Cyber Shield against autonomous cyberattacks](https://www.computing.co.uk/news/2026/government/ncsc-plans-ai-powered-cyber-shield-against-autonomous-cyberattacks)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5109