AI will heighten global ransomware threat, says NCSC

National security threat

James Babbage, director general for threats at the National Crime Agency (NCA), said: “Ransomware continues to be a national security threat. As this report shows, the threat is likely to increase in the coming years due to advancements in AI and the exploitation of this technology by cyber criminals.

“AI services lower barriers to entry, increasing the number of cyber criminals, and will boost their capability by improving the scale, speed and effectiveness of existing attack methods. Fraud and child sexual abuse are also particularly likely to be affected.

“The NCA will continue to protect the public and reduce the serious crime threat to the UK, including by targeting criminal use of GenAI and ensuring we adopt the technology ourselves where safe and effective,” he said.

The NCSC maintains that ransomware is the most acute cyber threat facing UK organisations as ransomware crews continue to adapt their business models in the search of more efficiencies and maximum profits.

Last year, for example, saw a divergence in tactics between some gangs, with a number bypassing the traditional ransom locker malware altogether in favour of straight up extortion, Cl0p/Clop being one of the more active proponents of this tactic.

The UK government is trying to tackle this rapidly changing threat model through its multibillion-pound Cyber Security Strategy, in which both the NCSC, its law enforcement partners and private industry are active participants.

ESET global cyber security advisor Jake Moore said: “AI has simply increased the power enabling cyber criminals to act quicker and at scale. Furthermore, whilst past and present phishing emails are fed into the algorithms and analysed by the technology, the better the outcomes naturally become. The volume of such attacks will inevitably increase, but until we find a robust and secure solution to this evolving problem, we need to act now to help teach people and businesses how to protect themselves with what is available.

“Social engineering has an impressive hold over people due to human interaction, but now AI can apply the same tactics from a technological perspective, it is becoming harder to mitigate,” he added.

“Trust is often difficult to gain, but clever social engineering techniques often pressure people to bypass their default defences. Ultimately, we need to educate people about these new attacks and to think twice before transferring money or divulging personal information when requested.”

“Impact overestimated”

But Ilia Kolochenko, CEO and chief architect of ImmuniWeb, rejected the premise of the report outright. “The impact of generative AI on cyber crime growth seems to be overestimated, to put it mildly,” he said.

“First, most cyber crime groups have been successfully using various forms of AI for years, including pre-LLM [large language model] forms of generative AI, and the introduction of LLMs will unlikely revolutionise their operations,” said Kolochenko.

“Second, while LLMs can help with a variety of simple tasks, such as writing attractive phishing emails or even generating primitive malware, they cannot do all the foundational tasks, such as deploying abuse-resistant infrastructure to host C&C servers or laundering the money received from the victims.

“Third, the ransomware ‘business’ already works very well,” he said. “It’s a mature, highly efficient and effective industry with its own players, economy, laws and hierarchy.”