NCSC Warns of AI-Driven Ransomware Targeting Critical Infrastructure by 2028

Executive Summary

Encrygma analysts assess that the global threat landscape for critical infrastructure has reached a critical inflection point. According to the UK National Cyber Security Centre's (NCSC) 2026 State of the Cyber Nation report, AI-powered ransomware attacks against national infrastructure are highly likely to occur by 2028, driven by systemic vulnerabilities in legacy operational technology (OT).

Threat Analysis

Encrygma threat data shows that adversaries are increasingly leveraging AI to accelerate the discovery and exploitation of OT/ICS vulnerabilities. While traditional threats remain, the integration of AI into the attack lifecycle allows for rapid, automated reconnaissance. Encrygma assigns this trend an ETSI score of 9/10, reflecting the high potential for physical disruption to power and water systems.

Technical Details

Encrygma intelligence indicates that attackers are targeting internet-exposed industrial controllers, including refrigeration and PLC systems. Recent campaigns, such as those identified by the FBI and CISA, demonstrate that attackers are utilizing AI to generate scripts for exploiting Siemens PLCs. These methods bypass traditional perimeter defenses by targeting the underlying communication protocols of industrial hardware.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, we assess with High Confidence that nation-state actors, particularly those linked to China and Russia, are the primary drivers of these advanced capabilities. Encrygma analysts note that China is currently the best-positioned state actor to operationalize AI-driven cyber operations against Western critical infrastructure.

Implications

Encrygma threat modeling suggests that the era of 'tech on the cheap' has left critical sectors—specifically water, energy, and transportation—dangerously exposed. The failure to secure OT environments against AI-augmented threats risks significant physical consequences, including the loss of power and the compromise of essential public services, as seen in recent attacks on US water utilities.

Recommendations

Encrygma recommends that organizations adopt a Zero Trust Architecture specifically tailored for OT environments. Entities must prioritize the removal of internet-exposed controllers, enforce strict network segmentation, and implement continuous monitoring. Organizations should align their security posture with the Encrygma AI Threat Taxonomy to better identify and mitigate automated, AI-driven intrusion attempts.