Skip to navigation

Threat reportThreat IntelligenceTL-2026-5269

NCSC Annual Review 2026: AI-enabled malware and exploitation of legacy technology expected to target UK critical national infrastructure by 2028

highTRACKING

The UK NCSC assesses that by 2028 attackers will likely use AI-enabled cyber capabilities to exploit known vulnerabilities in legacy technology at scale across UK critical national infrastructure (CNI). The NCSC handled over 200 incidents affecting UK CNI and its supporting ecosystem in the year to May 2026, around 75% linked to hostile states such as Russia, China and Iran. First disclosed .

Key facts for NCSC 2026 AI threat outlook

IdentifiersTL-2026-5269
Also known asNCSC Annual Review 2026, RUSI Annual Security Lecture 2026
SeverityHIGH
First disclosed
Exploitation statusNo exploitation observed (theoretical)
Affected productsMultiple Legacy technology in UK critical national infrastructure; Multiple Unmanaged edge devices (firewalls, VPNs, routers, IoT sensors)
Nation-state nexusRussia, China, Iran
MITRE ATT&CK techniquesT1190 Exploit Public-Facing Application, T1587.001 Malware, T1588.007 Artificial Intelligence, T1595.002 Vulnerability Scanning, T1657 Financial Theft
MotivationUNKNOWN
Target sectorscritical national infrastructure, energy, health, government administration, telecoms, technology, finance
Target regionsunited kingdom
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for NCSC 2026 AI threat outlook

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5269 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5269 Ransomware Precursor Recovery Inhibition (T1490)

Detects shadow copy deletion, backup catalog removal and boot recovery tampering that precede ransomware with data extortion, which the NCSC calls the most prevalent threat and expects to rise with AI-enabled malware against UK CNI.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1490, T1486, T1657, T1059.003
  • Data sources: sysmon, DeviceProcessEvents, windows_process_creation
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    ((Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*")
    OR (Image="*\\wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*")
    OR (Image="*\\bcdedit.exe" (CommandLine="*recoveryenabled*no*" OR CommandLine="*bootstatuspolicy*ignoreallfailures*"))
    OR (Image="*\\wbadmin.exe" (CommandLine="*delete*catalog*" OR CommandLine="*delete*backup*")))
| stats count min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS commands by host User Image ParentImage
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host User Image ParentImage commands count first_seen last_seen

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "bootstatuspolicy ignoreallfailures"))
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has_any ("delete catalog", "delete backup"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: TL-2026-5269 Ransomware Precursor Recovery Inhibition Commands
id: b2d94e7a-81c6-4f35-a0e9-5c7138fd2e64
status: experimental
description: Detects deletion of shadow copies, backup catalogs and boot recovery settings, the standard precursor to ransomware with extortion that the NCSC expects to rise with AI-enabled tooling against UK critical national infrastructure.
references:
    - https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks
    - https://intel.threadlinqs.com/threats/TL-2026-5269
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.impact
    - attack.t1490
    - attack.t1486
    - attack.t1657
    - attack.execution
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'bootstatuspolicy ignoreallfailures'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains:
            - 'delete catalog'
            - 'delete backup'
    condition: 1 of selection_*
falsepositives:
    - Backup software or imaging tools that prune shadow copies during maintenance
    - Administrators resetting boot configuration during recovery
level: high

Known false positives:

  • Backup or imaging software pruning shadow copies during maintenance
  • Administrators changing boot recovery settings

Tuning notes: Allow-list known backup agents by parent image and service account; treat any hit on a domain controller or OT-adjacent server as critical; correlate with mass file modification or ransom note creation.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5269 Sentinel Edge Device Exploitation After Vulnerability Scanning (T1190) · unlock with TL Creds
  • TL-2026-5269 Defender Ransomware Precursor Recovery Inhibition (T1490) · unlock with TL Creds
  • TL-2026-5269 Sentinel Lateral Movement Fan-Out from Compromised Foothold (T1021) · unlock with TL Creds
  • TL-2026-5269 Sigma Edge Device Web Exploitation or Scanning (T1190) · unlock with TL Creds
  • TL-2026-5269 Sigma Ransomware Precursor Recovery Inhibition (T1490) · unlock with TL Creds
  • TL-2026-5269 Sigma Remote Execution Tooling for Lateral Movement (T1021) · unlock with TL Creds
  • TL-2026-5269 Edge Device Exploitation After Vulnerability Scanning (T1190) · unlock with TL Creds
  • TL-2026-5269 Lateral Movement Fan-Out from Compromised Foothold (T1021) · unlock with TL Creds

Indicators of compromise for NCSC 2026 AI threat outlook

As of 2026-11-04, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5269.

9 indicators of compromise · unlock with TL Creds. Compare plans

How NCSC 2026 AI threat outlook works

This is a strategic threat assessment, not an active-exploitation event. It rests on the NCSC's public statements, principally the RUSI Annual Security Lecture delivered by NCSC CEO Dr Richard Horne on 17 June 2026 and the NCSC news item published the same day.

Key judgements: (1) In the year to May 2026 (June 2025 to May 2026 per Professional Security) the NCSC managed more than 200 cyber incidents affecting UK CNI and its supporting ecosystem, with around 75% linked to state actors; Russia, China and Iran are the hostile states named. (2) By 2028, AI-enabled cyber capabilities will likely be used by attackers to exploit known vulnerabilities in legacy technology at scale across CNI. The framing is that AI increases the speed and scale at which existing weaknesses are found and exploited, rather than creating new attack methods. The hunt skeleton also records the NCSC assessment that nation states will routinely use AI cyber capabilities and that AI-powered malware will have been used in a ransomware attack on UK CNI by 2028; that wording could not be independently confirmed in the fetched primary page, which uses the 'likely' phrasing for the AI-exploitation judgement, so treat it as the NCSC's forward-looking assessment as relayed by the secondary source.

Secondary reporting adds context. ITPro (18 June 2026) quotes Horne: 'We know that adversaries are prepositioning today, establishing footholds within technology that underpins critical national infrastructure', and references the 2024 attribution of Volt Typhoon activity against US critical infrastructure as comparison; the sectors discussed include technology, cloud infrastructure and telecommunications. Professional Security's RUSI comment piece describes state targeting of payment systems and critical services, exploitation of unmanaged edge devices (firewalls, VPNs, routers, IoT sensors), lateral movement across networks, and unpatched legacy technology, with AI shortening the time from vulnerability disclosure to exploitation. Insurance Journal (22 April 2026) reports the NCSC head's earlier warning of about four consequential attacks per week, 204 nationally significant attacks in September 2024 to August 2025 (double the prior year), and that ransomware 'remains the most prevalent threat', citing prior disruptive attacks on the NHS, Royal Mail, Jaguar Land Rover and Marks & Spencer.

The NCSC's three core recommendations to leaders are: understand exposure to threats, build stronger defences based on proven security fundamentals, and ensure operational continuity and rapid recovery after an attack. Related NCSC resources include its frontier AI guidance (ncsc.gov.uk/frontier-ai). A separate NCSC document titled 'Global ransomware threat expected to rise with AI, NCSC warns' (PDF metadata dated 2026-07-31) states that ransomware with extortion is expected to rise with AI and points to NCSC guidance on mitigating malware and ransomware, secure AI development guidelines and the 10 Steps framework; its text could only be partially extracted.

No CVEs, malware family names, CVSS scores, specific threat-group names (for 2026 CNI incidents) or network indicators are given in the sources. BeaconBeagle correlation was therefore not applicable (no IP/domain IOCs exist). The IOC records below are entity, technique and forecast-scenario markers for tracking and hunt-hypothesis use rather than blockable indicators. The Industrial Cyber source article and the Computer Weekly article returned HTTP 403 and were confirmed only through search summaries and the NCSC primary page; an Industrial Cyber URL surfaced by search turned out to cover the 2023 review and was not used.

MITRE ATT&CK techniques by tactic:

Initial Access

T1190 Exploit Public-Facing Application

Resource Development

T1587.001 Malware; T1588.007 Artificial Intelligence

Reconnaissance

T1595.002 Vulnerability Scanning

Impact

T1657 Financial Theft

Remediation for NCSC 2026 AI threat outlook

Patches

  • Shorten patch timelines for known vulnerabilities, since AI is assessed to speed up exploitation of existing flaws

Immediate actions

  • Inventory internet-exposed and legacy systems in CNI environments and prioritise known-vulnerability remediation
  • Understand organisational exposure to state-linked threats (NCSC recommendation 1)
  • Identify and secure unmanaged edge devices such as firewalls, VPNs, routers and IoT sensors

Workarounds

  • Segment and restrict access to legacy systems that cannot be patched

Longer-term hardening

  • Build stronger defences on proven security fundamentals (NCSC recommendation 2)
  • Plan for operational continuity and rapid recovery after an attack (NCSC recommendation 3)
  • Retire or isolate legacy technology that cannot be patched
  • Review NCSC frontier AI guidance at ncsc.gov.uk/frontier-ai
  • Apply NCSC guidance on mitigating malware and ransomware attacks

Affected and fixed versions

  • Multiple — Legacy technology in UK critical national infrastructure
    Vulnerable versions: Unpatched legacy systems with known vulnerabilities
  • Multiple — Unmanaged edge devices (firewalls, VPNs, routers, IoT sensors)
    Vulnerable versions: Unpatched or unmanaged devices

Timeline of NCSC 2026 AI threat outlook

  • End of the September 2024 to August 2025 review period in which the NCSC recorded 204 nationally significant cyberattacks, double the prior year (per Insurance Journal)
  • Press coverage reports the NCSC head warning the UK must brace for a rise in state-backed cyberattacks, with Iran and China driving regular significant attacks and ransomware remaining the most prevalent threat
  • End of the year-to-May-2026 reporting window in which the NCSC managed over 200 incidents affecting UK CNI, around 75% linked to state actors
  • NCSC publishes the news item 'Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems', including the assessment that AI-enabled capabilities will likely be used to exploit legacy technology at scale by 2028
  • NCSC CEO locked-ioc-8 delivers the RUSI Annual Security Lecture, naming Russia, China and Iran and recommending understanding exposure, strengthening fundamentals and ensuring rapid recovery
  • ITPro reports Horne's warning that adversaries are prepositioning today, establishing footholds within technology underpinning CNI
  • NCSC document 'Global ransomware threat expected to rise with AI, NCSC warns' carries a PDF creation date of 2026-07-31
  • NCSC forecast horizon ('by 2028'): AI-enabled exploitation of legacy technology at scale across CNI, and AI-powered malware used in a ransomware attack on UK CNI per the hunt skeleton

Sources cited for NCSC 2026 AI threat outlook

Further reading

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats