# NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure

> The UK NCSC Annual Review 2026 (1 Sep 2025 - 31 Aug 2026) says attackers use AI to research targets, craft social engineering, discover software flaws and develop exploit code, though no entirely new attack classes have been observed. It assesses AI-powered malware is highly likely to feature in a ransomware attack against UK critical national infrastructure by 2028.

- **Published:** 2026-11-05T04:36:06Z
- **Last reviewed:** 2026-11-05T04:36:06Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5294
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5294.png
- **ID:** TL-2026-5294
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 5

## Description

This is a forward-looking government assessment, not an active campaign. The UK National Cyber Security Centre (NCSC, part of GCHQ) published its tenth Annual Review, 'The State of the Cyber Nation', on 3 November 2026, covering 1 September 2025 to 31 August 2026. Per secondary reporting (Cyber Security News), the NCSC handled 80 nationally significant incidents, received 1,831 attack reports, supported 337 incidents through its Incident Management Team, and notified roughly 8,500 organisations of suspected compromise via its Early Warning service.

On AI, the review states that attackers use AI to research targets, craft social engineering messages, discover software flaws and develop exploit code more efficiently, but that no observed use of AI has enabled entirely new classes of attack. The NCSC assesses it is 'highly likely' that AI-powered malware will feature in a ransomware attack against UK critical national infrastructure between now and 2028, and expects China, Russia and other states to routinely use AI cyber capabilities by 2028. A related NCSC assessment document dated 31 July 2026 (PDF metadata) warns that the global ransomware threat is expected to rise with AI acting as an accelerant. Search-surfaced reporting (ITPro, Industrial Cyber) additionally attributes to the NCSC an assessment that by 2028 attackers will probably use AI-enabled capabilities to exploit known vulnerabilities in legacy technology at scale across CNI; these items were not fetched in full and should be treated as secondary.

According to the article, 88% of incidents across large organisations involved four initial access routes: public-facing applications, phishing, valid accounts and external remote services. These map to existing, well-understood ATT&CK techniques, so the AI risk is primarily one of speed and scale rather than novel tradecraft. Cited defensive priorities are accurate system inventory/visibility, prompt patching of exposed services, account access control, backup protection, incident response rehearsal, preparing for accelerated 'patch waves', passkey adoption, and mapping supplier dependencies.

Caveats: the NCSC primary report PDF could not be read in full (only the landing page was retrievable); statistics come from the secondary article. No CVEs, malware families, named threat actors, or technical IOCs are present in the sources. The IOC set below therefore records source entities, tracked ATT&CK technique references and defensive control concepts only, and no network or file indicators are fabricated.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1592 Gather Victim Host Information
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1587.001 Develop Capabilities: Malware
- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1133 External Remote Services
- T1490 Inhibit System Recovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Web Server Process Spawning Shell or Recon Utility (Webshell Activity)** (`TL-2026-5294-SPL-002`)

After exploiting a public-facing application (T1190) attackers commonly run commands from the web server worker process, often through a webshell (T1505.003, T1059). Flags IIS, Apache, nginx, PHP or Tomcat parent processes launching shells and reconnaissance utilities.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1505.003, T1059
- **Data sources:** sysmon, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ParentImage IN ("*\\w3wp.exe", "*\\httpd.exe", "*\\nginx.exe", "*\\php-cgi.exe", "*\\tomcat9.exe", "*\\tomcat10.exe")
    Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe", "*\\whoami.exe", "*\\certutil.exe", "*\\net.exe", "*\\net1.exe", "*\\bitsadmin.exe", "*\\mshta.exe", "*\\cscript.exe", "*\\wscript.exe")
| stats count values(Image) as children values(CommandLine) as command_lines min(_time) as first_seen max(_time) as last_seen by Computer, ParentImage, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "php-cgi.exe", "tomcat9.exe", "tomcat10.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "certutil.exe", "net.exe", "net1.exe", "bitsadmin.exe", "mshta.exe", "cscript.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Web Server Process Spawning Shell or Reconnaissance Utility
id: 2d9f6a18-83c4-4b57-a0e2-6f1b7c9d3e02
status: experimental
description: Detects a web server worker process launching a command shell or reconnaissance utility, typical of webshell activity after exploitation of a public-facing application.
references:
  - https://www.ncsc.gov.uk/collection/annual-review-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\tomcat9.exe'
      - '\tomcat10.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\certutil.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\cscript.exe'
      - '\wscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Web applications that intentionally invoke command-line tools for administration or deployment
  - Application pool health scripts
level: high

```

**Known false positives:**

- Web applications that deliberately shell out to helper utilities
- Deployment or patching scripts run under the application pool identity

**Tuning notes:** Allow-list known application command lines per host. Add Linux auditd execve coverage for httpd and nginx parents. Consider alerting on any child process of w3wp.exe on hardened servers.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Phishing Delivery of High-Risk Attachment Types to Mailboxes (T1566.001) (locked: unlock with TL Creds)
- Cloud Identity Username Enumeration and Password Spray Followed by Success (locked: unlock with TL Creds)
- Office Application Spawning Script Interpreter or Download Utility (locked: unlock with TL Creds)
- Backup and Shadow Copy Destruction Commands Before Encryption (T1490) (locked: unlock with TL Creds)
- Mass Ransom Note Creation and Encrypted File Extensions (T1486) (locked: unlock with TL Creds)
- Backup, Database and Security Service Stop Burst Before Encryption (T1489) (locked: unlock with TL Creds)
- Web Exploitation Patterns Against Public-Facing Applications (T1190) (locked: unlock with TL Creds)
- External Logons After Repeated Failures on Remote Services (Valid Accounts Abuse) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [NCSC Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure](https://cybersecuritynews.com/ai-could-accelerate-ransomware/)
- [NCSC Annual Review 2026 (The State of the Cyber Nation)](https://www.ncsc.gov.uk/collection/annual-review-2026)
- [NCSC: Global ransomware threat expected to rise with AI](https://www.ncsc.gov.uk/sites/default/files/2026-07/Global-ransomware-threat-expected-to-rise-with-AI-NCSC-warns.pdf)
- [UK NCSC report warns of increased ransomware threat with rise of AI affecting cyber operations](https://industrialcyber.co/ai/uk-ncsc-report-warns-of-increased-ransomware-threat-with-rise-of-ai-affecting-cyber-operations/)
- [NCSC: AI will increase speed and scale of critical infrastructure attacks](https://itpro.com/security/ncsc-ai-will-increase-speed-and-scale-of-critical-infrastructure-attacks)
- [UK Says Iran, China Drive Regular Significant Cyberattacks](https://amp.insurancejournal.com/news/international/2026/04/22/866825.htm)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5294