Threat video1:00
NCSC Annual Review 2026 AI Ransomware: Detection & IOCs
NCSC expects AI-built ransomware to hit UK critical infrastructure by 2028. Hunt it with 9 detection rules, 5 IOCs and a free Splunk SPL rule.
Chapters
- 0:00The hookNCSC warns: by 2028, AI accelerates ransomware.
- 0:05The storyAI accelerates ransomware development.
- 0:12Attack pathAccording to NCSC, AI accelerates reconnaissance.
- 0:30AttributionNo threat actor is attributed.
- 0:34Indicators of compromiseNo malicious indicators were published.
- 0:39MITRE ATT&CK techniques9 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation3 steps now: Maintain an accurate inventory of internet-exposed systems and prioritise patching.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00NCSC warns: by 2028, AI accelerates ransomware.
0:06AI accelerates ransomware development.
0:09UK infrastructure threatened by 2028.
0:13According to NCSC, AI accelerates reconnaissance.
0:17Attack preparation accelerated.
0:19Then initial access via multiple vectors.
0:22AI ransomware deploys across infrastructure.
0:25Recovery destroyed; data encryption seals impact.
0:30No threat actor is attributed. Confidence: low.
0:34No malicious indicators were published.
0:399 ATT&CK techniques, from reconnaissance to impact.
0:443 steps now: Maintain an accurate inventory of internet-exposed systems and prioritise patching.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.