UK Cyber Security Centre: “AI hacking will threaten national infrastructure” [Global AI Briefing]

[Financial News] A warning has been issued that cyberattacks using artificial intelligence (AI) are likely to target critical national infrastructure, including power, water and factories, by 2028.
In particular, the cyber threat posed by AI lies not in developing new attack techniques but in greatly increasing the scale and speed of existing cyberattacks, including hackers’ searches for targets, discovery of security vulnerabilities and creation of malware. This has prompted calls for public institutions and companies to strengthen security checks on existing facilities to reduce the damage caused by AI cyberattacks. 
According to reports on the 4th, local time, by major foreign news outlets including The Guardian, the National Cyber Security Centre (NCSC), which is part of the UK’s Government Communications Headquarters (GCHQ), warned in its annual cybersecurity report that “AI-enabled malware is very likely to be used in ransomware attacks targeting the UK’s critical national infrastructure by 2028.” 

NCSC Director Richard Horne said, “Critical infrastructure includes power, water, transport, communications, healthcare and food supply chains,” and stressed that “if attackers use AI to identify vulnerable systems and create malware, they can attack more facilities at less cost and in less time than before.”
The report assessed that state-level attackers, including those from Russia and China, are highly likely to routinely use AI-based cyberattacks to achieve geopolitical objectives by 2028. 
The report predicted that AI would be used less to create entirely new hacking methods than to make existing attack methods far more efficient. This includes searching for targets, identifying network vulnerabilities, and automating phishing and social engineering attacks.
It added that the creation of malware needed for ransomware attacks, as well as the execution of the attacks themselves, could also be carried out on a large scale using AI.
The NCSC advised that “companies and public institutions must first change the practice of neglecting outdated information technology (IT) and industrial control systems,” and that they “should disconnect equipment unnecessarily connected to the internet and strengthen basic security measures, including security updates, restrictions on administrators’ access privileges, and data backups.”
Director Horne warned that the so-called “tech on the cheap”—skimping on security investment—can no longer be sustained.
Meanwhile, European countries including France and the UK have recently been grappling with cyberattacks targeting supermarket refrigeration and freezer equipment. Hackers remotely manipulated equipment temperatures by exploiting known vulnerabilities, including outdated control devices for refrigeration equipment directly connected to the internet and default passwords. Director Horne noted, “This incident shows how important security investment in industrial equipment is.”

[email protected] Lee Gu-sun Reporter