AI-Powered Ransomware by 2028: A Date With No Source

The Register warns that AI-powered ransomware attacks will reach Britain by 2028, but the text available to us names no agency, report or data behind that date. For Cyprus and EU firms, the direction matters more than the year: intrusions are getting faster, and NIS2, DORA and CySEC already require proof that defenses can keep pace.

What did The Register publish, and what backs it?

On 3 November 2026, The Register’s security section ran the headline “Britain on notice: AI-powered ransomware attacks to arrive by 2028.” The text we could review carries no byline, named issuer or figures. We can’t tell whether 2028 is an official assessment, an extrapolation or the writer’s own reading, so we treat it as a planning signal, not a forecast.

The direction is documented. In January 2024, the UK National Cyber Security Centre (NCSC) said AI would “almost certainly” increase the volume and impact of cyber attacks over the following two years, with the biggest gains in reconnaissance and social engineering and a lower skill bar for novice attackers. That supports the trend, not the date.

What does AI-powered ransomware mean in practice?

AI-powered ransomware is ordinary ransomware with AI speeding up each step, not a payload that runs itself. That can mean phishing in fluent Greek or English, cloned voices in phone scams, faster weaponization of public exploits, rapid variant generation to dodge antivirus signatures, or automated ransom negotiation.

The intrusion still needs a way in (phishing, exposed remote access, unpatched edge appliances, valid credentials), privilege abuse, lateral movement and an extortion lever such as encrypted servers or stolen data.

Scale doesn’t need AI either. In May 2017, WannaCry used the EternalBlue SMB exploit and plain automation to hit more than 200,000 victims in at least 150 countries, by Europol’s early estimate. What AI changes for defenders:

• Less time from first foothold to ransom demand.
• More consistent attacks from low-skilled affiliates.
• More simultaneous campaigns than human operators could run.
• Less value from signature-based detection.

Which controls fail first when intrusions move faster?

Controls that run at human speed fail first. No CVE or patch is attached to this warning, so the fixes are structural:

• Edge inventory and patch speed. Keep a live list of VPNs, remote access gateways and edge appliances, and measure patch windows in days, not weeks.
• Phishing-resistant MFA. FIDO2 or passkeys on remote access, the identity provider and privileged accounts.
• Help desk resets. A familiar voice no longer proves identity. Verify callers through an independent channel before any password, MFA or recovery-contact change.
• Behavioral detection. Alert on unusual credential use, rapid network discovery, lateral movement, mass file changes and attempts to delete backups.
• Backups. Keep them offline or immutable with separate credentials, and rehearse restores. CISA’s #StopRansomware guide recommends offline, encrypted backups.

Practitioner’s note: Two failures recur in restore exercises. Files come back but the business doesn’t, because Active Directory, the identity provider, the hypervisor or the backup console is still in attacker hands. And someone wipes the first infected laptop before saving identity provider, VPN, email, EDR and edge-device logs, leaving no proof of breach scope for an insurer or regulator.

Why is 2028 the wrong date to wait for in Cyprus?

Because the obligations that matter already apply. A Limassol EMI, iGaming operator or ship manager offers attackers the same pressure points as a UK company: client data, payment operations and hourly downtime costs. The 14 to 26 months until 2028 span one to two budget cycles, about the time it takes to fund, test and fix.

Under NIS2 Article 23, in-scope entities send an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month of that notification. In Cyprus, these go to the Digital Security Authority and the national CSIRT; confirm your sector’s route before an incident, not during one.

DORA has applied to in-scope financial entities since 17 January 2025, covering ICT risk, incident reporting, resilience testing and third-party risk. Entities designated for threat-led penetration testing (TLPT) must run it at least every three years. If an AI-assisted intrusion reaches encryption in hours, these clocks start while your team is still scoping the damage.

How should a regulated firm evidence AI-powered ransomware readiness?

With test results, not a news clipping. A board should ask three questions: how far does an attacker get from one compromised laptop, how long until we notice, and can we restore while our identity systems are untrusted?

An assumed breach assessment answers the first two. A ransomware readiness assessment tests the third, including backup administration and escalation to decision-makers. An authorized phishing simulation shows whether polished lures still work on staff and the help desk.

Record scope, findings and remediation dates for every test; a CySEC, DORA or PCI DSS review will ask for them. Our NIS2 and DORA compliance readiness work maps those records to what a supervisor will check.

FAQ

Is the 2028 AI ransomware warning from the NCSC or another named body?

The available text names no issuing body. The NCSC's January 2024 AI threat assessment does not set a 2028 date.

Has an AI-powered ransomware campaign against Britain already been confirmed?

No. The headline is a prediction and cites no observed incident, campaign or victim.

Will antivirus signatures stop AI-generated ransomware variants?

Don't rely on them. Detect behavior instead: unusual credential use, mass file changes and attempts to delete backups.

If you want evidence rather than a forecast, our ransomware readiness assessment tests detection, escalation and recovery against a fast-moving intrusion, with findings mapped to NIS2 and DORA.