NCSC says AI will increase ransomware, cyberthreats

Ransomware risks increase

While AI might contribute to more advanced phishing attacks and therefore an increase in ransomware, the NCSC said it could also widen the pool of capable threat actors that conduct ransomware attacks. "Threat actors, including ransomware actors, are already using AI to increase the efficiency and effectiveness of aspects of cyber operations, such as reconnaissance, phishing and coding," the report said, warning that "enhanced access will likely contribute to the global ransomware threat over the next two years."

One factor that contributed to an increase in ransomware activity over the years was the as-a-service business model. Ransomware as a service expanded the threat because affiliates do not need coding experience; they can instead purchase ransomware programs from different gangs, which in turn take a percentage of whatever ransom payments the affiliates receive.

The report assessed that as-a-service business models will continue to benefit amateur or less skilled threat actors in a variety of ways in addition to ransomware. That could include GenAI as a service, which the NCSC said could already be in development.

"Commoditisation of cyber crime capability, for example 'as-a-service' business models, makes it almost certain that capable groups will monetise AI-enabled cyber tools, making improved capability available to anyone willing to pay," the report said.

Another prominent risk addressed in the report was how quickly threat actors are exploiting software vulnerabilities. The time between patch releases and exploitation has already decreased, the report warned, and AI will only exacerbate the problem. "AI is highly likely to accelerate this challenge as reconnaissance to identify vulnerable devices becomes quicker and more precise," the NCSC said.

However, the NCSC assessed that GenAI tools would only provide "minimal uplift" in malware and exploit development for capable state actors and organized cybercrime groups. Another positive outlook from the agency was how AI can improve threat detection capabilities and help identify phishing campaigns for defenders.

Nitin Natarajan, deputy director at CISA, told TechTarget Editorial that while AI could make it easier for ransomware actors, he also sees some positive outcomes and benefits that organizations including CISA can add to their repertoire. However, he agreed with the NCSC that the technology could improve phishing emails and malicious coding capabilities, which would create new risks for organizations, especially those that already struggle with identifying malicious messages.

"It used to be very easy to tell a phishing email. The graphics weren't there, or you could tell it was written by a non-native English speaker," he said. "I think generally in the ransomware space there are going to be benefits to bad actors, and we just need to continue to stay one step ahead."

Tamara Chacon, security strategist at Splunk, said AI tools will increase the speed at which phishing content is created, but the quality of that content is another matter. "GenAI is going to have a role in cyber threats, this is known," she told TechTarget Editorial. "But when it comes to crafting phishing emails, it just becomes quicker to push out but doesn't create a superior phisher."

Senior news writer Alexander Culafi contributed to this article.

Arielle Waldman is a Boston-based reporter covering enterprise security news.