# NCSC Annual Review 2026: AI-enabled malware and exploitation of legacy technology expected to target UK critical national infrastructure by 2028

> The UK NCSC assesses that by 2028 attackers will likely use AI-enabled cyber capabilities to exploit known vulnerabilities in legacy technology at scale across UK critical national infrastructure (CNI). The NCSC handled over 200 incidents affecting UK CNI and its supporting ecosystem in the year to May 2026, around 75% linked to hostile states such as Russia, China and Iran.

- **Published:** 2026-11-04T20:55:30Z
- **Last reviewed:** 2026-11-04T20:55:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5269
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5269.png
- **ID:** TL-2026-5269
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

This is a strategic threat assessment, not an active-exploitation event. It rests on the NCSC's public statements, principally the RUSI Annual Security Lecture delivered by NCSC CEO Dr Richard Horne on 17 June 2026 and the NCSC news item published the same day.

Key judgements: (1) In the year to May 2026 (June 2025 to May 2026 per Professional Security) the NCSC managed more than 200 cyber incidents affecting UK CNI and its supporting ecosystem, with around 75% linked to state actors; Russia, China and Iran are the hostile states named. (2) By 2028, AI-enabled cyber capabilities will likely be used by attackers to exploit known vulnerabilities in legacy technology at scale across CNI. The framing is that AI increases the speed and scale at which existing weaknesses are found and exploited, rather than creating new attack methods. The hunt skeleton also records the NCSC assessment that nation states will routinely use AI cyber capabilities and that AI-powered malware will have been used in a ransomware attack on UK CNI by 2028; that wording could not be independently confirmed in the fetched primary page, which uses the 'likely' phrasing for the AI-exploitation judgement, so treat it as the NCSC's forward-looking assessment as relayed by the secondary source.

Secondary reporting adds context. ITPro (18 June 2026) quotes Horne: 'We know that adversaries are prepositioning today, establishing footholds within technology that underpins critical national infrastructure', and references the 2024 attribution of Volt Typhoon activity against US critical infrastructure as comparison; the sectors discussed include technology, cloud infrastructure and telecommunications. Professional Security's RUSI comment piece describes state targeting of payment systems and critical services, exploitation of unmanaged edge devices (firewalls, VPNs, routers, IoT sensors), lateral movement across networks, and unpatched legacy technology, with AI shortening the time from vulnerability disclosure to exploitation. Insurance Journal (22 April 2026) reports the NCSC head's earlier warning of about four consequential attacks per week, 204 nationally significant attacks in September 2024 to August 2025 (double the prior year), and that ransomware 'remains the most prevalent threat', citing prior disruptive attacks on the NHS, Royal Mail, Jaguar Land Rover and Marks & Spencer.

The NCSC's three core recommendations to leaders are: understand exposure to threats, build stronger defences based on proven security fundamentals, and ensure operational continuity and rapid recovery after an attack. Related NCSC resources include its frontier AI guidance (ncsc.gov.uk/frontier-ai). A separate NCSC document titled 'Global ransomware threat expected to rise with AI, NCSC warns' (PDF metadata dated 2026-07-31) states that ransomware with extortion is expected to rise with AI and points to NCSC guidance on mitigating malware and ransomware, secure AI development guidelines and the 10 Steps framework; its text could only be partially extracted.

No CVEs, malware family names, CVSS scores, specific threat-group names (for 2026 CNI incidents) or network indicators are given in the sources. BeaconBeagle correlation was therefore not applicable (no IP/domain IOCs exist). The IOC records below are entity, technique and forecast-scenario markers for tracking and hunt-hypothesis use rather than blockable indicators. The Industrial Cyber source article and the Computer Weekly article returned HTTP 403 and were confirmed only through search summaries and the NCSC primary page; an Industrial Cyber URL surfaced by search turned out to cover the 2023 review and was not used.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.007 Artificial Intelligence
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5269 Ransomware Precursor Recovery Inhibition (T1490)** (`TL-2026-5269-SPL-002`)

Detects shadow copy deletion, backup catalog removal and boot recovery tampering that precede ransomware with data extortion, which the NCSC calls the most prevalent threat and expects to rise with AI-enabled malware against UK CNI.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1486, T1657, T1059.003
- **Data sources:** sysmon, DeviceProcessEvents, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    ((Image="*\\vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*")
    OR (Image="*\\wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*")
    OR (Image="*\\bcdedit.exe" (CommandLine="*recoveryenabled*no*" OR CommandLine="*bootstatuspolicy*ignoreallfailures*"))
    OR (Image="*\\wbadmin.exe" (CommandLine="*delete*catalog*" OR CommandLine="*delete*backup*")))
| stats count min(_time) AS first_seen max(_time) AS last_seen values(CommandLine) AS commands by host User Image ParentImage
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host User Image ParentImage commands count first_seen last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_all ("delete", "shadows"))
    or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
    or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "bootstatuspolicy ignoreallfailures"))
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine has_any ("delete catalog", "delete backup"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: TL-2026-5269 Ransomware Precursor Recovery Inhibition Commands
id: b2d94e7a-81c6-4f35-a0e9-5c7138fd2e64
status: experimental
description: Detects deletion of shadow copies, backup catalogs and boot recovery settings, the standard precursor to ransomware with extortion that the NCSC expects to rise with AI-enabled tooling against UK critical national infrastructure.
references:
    - https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks
    - https://intel.threadlinqs.com/threats/TL-2026-5269
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.impact
    - attack.t1490
    - attack.t1486
    - attack.t1657
    - attack.execution
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'bootstatuspolicy ignoreallfailures'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains:
            - 'delete catalog'
            - 'delete backup'
    condition: 1 of selection_*
falsepositives:
    - Backup software or imaging tools that prune shadow copies during maintenance
    - Administrators resetting boot configuration during recovery
level: high

```

**Known false positives:**

- Backup or imaging software pruning shadow copies during maintenance
- Administrators changing boot recovery settings

**Tuning notes:** Allow-list known backup agents by parent image and service account; treat any hit on a domain controller or OT-adjacent server as critical; correlate with mass file modification or ransom note creation.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5269 Sentinel Edge Device Exploitation After Vulnerability Scanning (T1190) (locked: unlock with TL Creds)
- TL-2026-5269 Defender Ransomware Precursor Recovery Inhibition (T1490) (locked: unlock with TL Creds)
- TL-2026-5269 Sentinel Lateral Movement Fan-Out from Compromised Foothold (T1021) (locked: unlock with TL Creds)
- TL-2026-5269 Sigma Edge Device Web Exploitation or Scanning (T1190) (locked: unlock with TL Creds)
- TL-2026-5269 Sigma Ransomware Precursor Recovery Inhibition (T1490) (locked: unlock with TL Creds)
- TL-2026-5269 Sigma Remote Execution Tooling for Lateral Movement (T1021) (locked: unlock with TL Creds)
- TL-2026-5269 Edge Device Exploitation After Vulnerability Scanning (T1190) (locked: unlock with TL Creds)
- TL-2026-5269 Lateral Movement Fan-Out from Compromised Foothold (T1021) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems](https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks)
- [NCSC Annual Review 2026 warns AI-powered malware could target UK critical infrastructure by 2028 (Industrial Cyber)](https://industrialcyber.co/critical-infrastructure/ncsc-annual-review-2026-warns-ai-powered-malware-could-target-uk-critical-infrastructure-by-2028/)
- [Hostile states launched 200 attacks on UK infrastructure in five months, says NCSC chief (Computer Weekly)](https://www.computerweekly.com/news/366644872/Hostile-states-launched-200-attacks-on-UK-infrastructure-in-five-months-says-NCSC-chief)
- [Hostile states behind three-quarters of UK critical infrastructure attacks (ITPro)](https://www.itpro.com/security/hostile-states-behind-three-quarters-of-uk-critical-infrastructure-attacks)
- [RUSI Annual Security Lecture 2026 comment (Professional Security)](https://professionalsecurity.co.uk/news/interviews/rusi-annual-security-lecture-2026-comment/)
- [RUSI Annual Security Lecture: Richard Horne, CEO NCSC (recording)](https://www.rusi.org/members-event-recordings/recording-annual-security-lecture-richard-horne-ceo-ncsc)
- [Global ransomware threat expected to rise with AI, NCSC warns](https://www.ncsc.gov.uk/sites/default/files/2026-07/Global-ransomware-threat-expected-to-rise-with-AI-NCSC-warns.pdf)
- [UK Says Iran, China Drive Regular Significant Cyberattacks (Insurance Journal)](https://amp.insurancejournal.com/news/international/2026/04/22/866825.htm)
- [UK Must Brace for Rise in State-Backed Cyberattacks, Security Chief Says (Daily Maverick)](https://www.dailymaverick.co.za/article/2026-04-22-uk-must-brace-for-rise-in-state-backed-cyberattacks-security-chief-says)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5269