Is AI-powered ransomware already hitting UK organisations?

The review is explicit that its warning about ransomware on essential UK services, using AI-built malware, is a forecast. It does not confirm that any such incident has happened [7]. The assessment sets the window as the period up to 2028 [2].

NCSC responders report that criminals have started using AI tools in live incidents, but nothing they saw opened up a new class of attack [7]. The help is practical: researching victims, drafting social engineering messages, finding software flaws and producing exploit code more efficiently [7]. Skilled operators gain most, since they can check output and fix mistakes [7].

The Register noted that the NCSC said little about what form such malware may take, although it pointed to open source security tools being turned to harmful use [5]. Treat claims about named AI ransomware families with caution unless a primary source confirms them.

Ransomware readiness takes preparation: inventories, tested backups, agreed decision rights. A forecast running to 2028 leaves room to do that work before pressure builds. The NCSC expects AI to be used mainly to improve existing operations, not to hand complete attacks to autonomous systems [7].