NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure

Key facts for TL-2026-5294

Detection coverage for TL-2026-5294

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5294 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Web Server Process Spawning Shell or Recon Utility (Webshell Activity)

After exploiting a public-facing application (T1190) attackers commonly run commands from the web server worker process, often through a webshell (T1505.003, T1059). Flags IIS, Apache, nginx, PHP or Tomcat parent processes launching shells and reconnaissance utilities.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1505.003, T1059
• Data sources: sysmon, microsoft_defender_for_endpoint
• Severity: high
• Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage IN ("*\\w3wp.exe", "*\\httpd.exe", "*\\nginx.exe", "*\\php-cgi.exe", "*\\tomcat9.exe", "*\\tomcat10.exe")
    Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\whoami.exe", "*\\certutil.exe", "*\\net.exe", "*\\net1.exe", "*\\bitsadmin.exe", "*\\mshta.exe", "*\\cscript.exe", "*\\wscript.exe")
| stats count values(Image) as children values(CommandLine) as command_lines min(_time) as first_seen max(_time) as last_seen by Computer, ParentImage, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "tomcat9.exe", "tomcat10.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "certutil.exe", "net.exe", "net1.exe", "bitsadmin.exe", "mshta.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine

Sigma

title: Web Server Process Spawning Shell or Reconnaissance Utility
id: 2d9f6a18-83c4-4b57-a0e2-6f1b7c9d3e02
status: experimental
description: Detects a web server worker process launching a command shell or reconnaissance utility, typical of webshell activity after exploitation of a public-facing application.
references:
  - https://www.ncsc.gov.uk/collection/annual-review-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\certutil.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\cscript.exe'
      - '\wscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Web applications that intentionally invoke command-line tools for administration or deployment
  - Application pool health scripts
level: high

Known false positives:

• Web applications that deliberately shell out to helper utilities
• Deployment or patching scripts run under the application pool identity

Tuning notes: Allow-list known application command lines per host. Add Linux auditd execve coverage for httpd and nginx parents. Consider alerting on any child process of w3wp.exe on hardened servers.

• 🔒 Phishing Delivery of High-Risk Attachment Types to Mailboxes (T1566.001) · unlock with TL Creds
• 🔒 Cloud Identity Username Enumeration and Password Spray Followed by Success · unlock with TL Creds
• 🔒 Office Application Spawning Script Interpreter or Download Utility · unlock with TL Creds
• 🔒 Backup and Shadow Copy Destruction Commands Before Encryption (T1490) · unlock with TL Creds
• 🔒 Mass Ransom Note Creation and Encrypted File Extensions (T1486) · unlock with TL Creds
• 🔒 Backup, Database and Security Service Stop Burst Before Encryption (T1489) · unlock with TL Creds
• 🔒 Web Exploitation Patterns Against Public-Facing Applications (T1190) · unlock with TL Creds
• 🔒 External Logons After Repeated Failures on Remote Services (Valid Accounts Abuse) · unlock with TL Creds

Indicators of compromise for TL-2026-5294

As of 2026-11-05, Threadlinqs Intelligence tracks 5 indicators of compromise for TL-2026-5294.

How NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware works

This is a forward-looking government assessment, not an active campaign. The UK National Cyber Security Centre (NCSC, part of GCHQ) published its tenth Annual Review, 'The State of the Cyber Nation', on 3 November 2026, covering 1 September 2025 to 31 August 2026. Per secondary reporting (Cyber Security News), the NCSC handled 80 nationally significant incidents, received 1,831 attack reports, supported 337 incidents through its Incident Management Team, and notified roughly 8,500 organisations of suspected compromise via its Early Warning service.

On AI, the review states that attackers use AI to research targets, craft social engineering messages, discover software flaws and develop exploit code more efficiently, but that no observed use of AI has enabled entirely new classes of attack. The NCSC assesses it is 'highly likely' that AI-powered malware will feature in a ransomware attack against UK critical national infrastructure between now and 2028, and expects China, Russia and other states to routinely use AI cyber capabilities by 2028. A related NCSC assessment document dated 31 July 2026 (PDF metadata) warns that the global ransomware threat is expected to rise with AI acting as an accelerant. Search-surfaced reporting (ITPro, Industrial Cyber) additionally attributes to the NCSC an assessment that by 2028 attackers will probably use AI-enabled capabilities to exploit known vulnerabilities in legacy technology at scale across CNI; these items were not fetched in full and should be treated as secondary.

According to the article, 88% of incidents across large organisations involved four initial access routes: public-facing applications, phishing, valid accounts and external remote services. These map to existing, well-understood ATT&CK techniques, so the AI risk is primarily one of speed and scale rather than novel tradecraft. Cited defensive priorities are accurate system inventory/visibility, prompt patching of exposed services, account access control, backup protection, incident response rehearsal, preparing for accelerated 'patch waves', passkey adoption, and mapping supplier dependencies.

Caveats: the NCSC primary report PDF could not be read in full (only the landing page was retrievable); statistics come from the secondary article. No CVEs, malware families, named threat actors, or technical IOCs are present in the sources. The IOC set below therefore records source entities, tracked ATT&CK technique references and defensive control concepts only, and no network or file indicators are fabricated.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing

Impact

T1490 Inhibit System Recovery

Resource Development

T1587.001 Develop Capabilities: Malware; T1588.007 Obtain Capabilities: Artificial Intelligence

Reconnaissance

T1589 Gather Victim Identity Information; T1592 Gather Victim Host Information

Remediation for NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware

Immediate actions

• Maintain an accurate inventory of internet-exposed systems and prioritise patching of public-facing applications and external remote services
• Review and restrict account access; audit valid accounts and remote access paths
• Protect backups (offline/immutable) and verify restoration

Longer-term hardening

• Adopt passkeys / phishing-resistant authentication
• Rehearse incident response, including ransomware scenarios against critical services
• Map supplier and third-party dependencies
• Prepare operationally for accelerated vulnerability 'patch waves' driven by AI-assisted exploit development

Affected and fixed versions

• UK Critical National Infrastructure — Public-facing applications, external remote services, and legacy technology in CNI sectors

Timeline of NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware

• 2025-09-01 Start of the NCSC Annual Review 2026 reporting period (1 Sep 2025 - 31 Aug 2026).
• 2026-04-22 Insurance Journal reports UK statements that Iran and China drive regular significant cyberattacks against the UK.
• 2026-07-31 NCSC document 'Global ransomware threat expected to rise with AI' created (per PDF metadata), assessing AI as an accelerant for ransomware.
• 2026-08-31 End of the NCSC Annual Review 2026 reporting period.
• 2026-11-03 locked-ioc-4 reports the NCSC warning that AI-powered malware is highly likely to feature in a ransomware attack on UK CNI by 2028.
• 2026-11-03 NCSC publishes Annual Review 2026 'The State of the Cyber Nation' (its tenth year as part of locked-ioc-5): 80 nationally significant incidents, 1,831 attack reports, 88% of large-organisation incidents via four access routes.
• 2028-12-31 NCSC forecast horizon ('by 2028'): AI-powered malware highly likely to feature in a ransomware attack against UK CNI; China, Russia and other states expected to routinely use AI cyber capabilities.

Sources cited for NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware

• NCSC Annual Review 2026 (The State of the Cyber Nation) NCSC (UK) · Advisory · 2026-11-03
• NCSC: Global ransomware threat expected to rise with AI NCSC (UK) · Advisory · 2026-07-31
• NCSC Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure cybersecuritynews.com · News · 2026-11-03
• UK NCSC report warns of increased ransomware threat with rise of AI affecting cyber operations industrialcyber.co · News
• NCSC: AI will increase speed and scale of critical infrastructure attacks itpro.com · News
• UK Says Iran, China Drive Regular Significant Cyberattacks amp.insurancejournal.com · News · 2026-04-22

More in ransomware

• Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk
• The State of Ransomware in Financial Services 2026 (Sophos survey)
• Nova (formerly RALord) Ransomware-as-a-Service Group
• Hawkmoth Anubis Ransomware Attack Uses New Backdoor.Lindnor and BYOVD Security Killers Against U.S. Organization
• BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass)

Further reading

• Ransomware C2 Hosting Abuse: LockBit, BianLian
• ChromaDB, LiteLLM, PraisonAI, Langflow RCEs