Computer Repair · November 4, 2026 · ComputerKing Team

AI Makes Ransomware and Phishing Faster and More Convincing? The UK NCSC Says an AI Ransomware Attack Is Highly Likely Before 2028: Hong Kong SMEs Need Not Panic, but Must Fix the Basics

On 3 November 2026 the UK NCSC judged it highly likely that AI-powered malware will appear in a ransomware attack on critical infrastructure before 2028. No new tool is needed: Hong Kong SMEs should first fix updates, multi-factor authentication, least privilege, and offline backups plus restore testing. Charges require an individual quotation.

Summary: The UK National Cyber Security Centre (NCSC) published its annual review, State of the Cyber Nation, on 3 November 2026, judging it "highly likely" that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure before 2028. The point is not to fear a future event that has not happened. It is the mechanism the NCSC states plainly: AI increases the scale and efficiency of ransomware, social engineering, and vulnerability exploitation, while the way in often remains an old weakness. This article translates that warning into basics a Hong Kong small business can actually do, without buying any new tool. Charges require an individual quotation.

What the news actually said, and three misreadings to avoid

First, be precise about what the NCSC said, so the message does not mutate as it gets passed along:

• The judgement itself: The NCSC judges it "highly likely" that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure between now and 2028. That is a graded probability judgement, not a prophecy, and not a claim that a particular attack has already happened.
• The mechanism: The report says AI will make attackers' operations larger and more efficient, including ransomware, social engineering, and the exploitation of software vulnerabilities. Reporting quotes the NCSC chief's point that the threat stems less from new attack techniques than from old weaknesses that have been tolerated.
• The background figures: The UK government also announced £60 million for the first phase of a national Cyber Shield and £70 million for a new centre to find weaknesses across critical infrastructure. Those are UK government-level investments, not a shopping list for a small business.

Avoid three misreadings: first, do not automatically turn "UK critical infrastructure" into "my company will be hit next week"; second, the report names no specific AI tool and no specific attacker, so distrust any claim that "the NCSC named this tool"; third, do not treat this warning as a reason to buy a particular AI protection product, since the NCSC's own emphasis is sustained investment and basic resilience, not a single clever tool.

What it really means for a Hong Kong small business: faster, more convincing, same old holes

Pull the UK warning back into a Hong Kong small business's daily life, and it breaks into three concrete layers:

Layer one: phishing messages will look more genuine. Social engineering already works by getting someone to click or hand over information, and AI makes those messages read more naturally and more targeted at a person or a company. The obviously odd English and wrong salutations of the past may become rarer, replaced by messages impersonating a boss, a supplier, or a customer, in a tone and format that look real. This is the same road as the WhatsApp "financial document" ZIP trap in Article 61 on this site and the ClickFix trick of getting people to paste commands in Article 70, only better disguised.

Layer two: finding vulnerabilities will get faster. If a system stays unpatched for a long time, the speed at which an attacker finds the way in only increases. Hong Kong users have just seen this lesson in the Synology incident: Articles 143 and 147 on this site cover the C3RB3R and .L0CK3D wave, whose way in was outdated DSM and vulnerabilities that had long since been patched, not some brand-new zero-day. In the AI era, old holes will be found faster, not slower.

Layer three: being small does not make you safe. Attackers scanning the whole internet with automation do not skip a company because it is small. For a small business, the real difference is not "will we be targeted" but "if something happens, can we restore, and does anyone know what to do".

The basics checklist: six things that need no new tool

Translated into small-business actions, the NCSC warning becomes six basics, none of which requires buying a new product first:

1. Do not let updates slide. Schedule security updates for PCs, NAS devices, and routers, instead of postponing them indefinitely because "everything works fine right now". The longer an old hole stays open, the more likely automated scanning finds it.

2. Turn on multi-factor authentication for important accounts. Email, cloud drives, and company systems should not rely on a password alone. Multi-factor authentication is one of the lowest-cost, most practical defences available.

3. Give the least privilege that is enough. Not everyone needs administrator rights, and one shared account should not run the whole company. Whoever needs to see which data gets exactly that, so even if one account is compromised, the blast radius stays limited.

4. Back up offline, and test the restore. A backup is not safety by itself. As Articles 79 and 82 on this site explain, use the 3-2-1 split, keep one offline copy, and regularly verify that a restore actually works. Article 115's SafePay advisory already showed ransomware operators deliberately deleting backups, so a backup file sitting on the same network does not count as safe.

5. Verify suspicious messages through a second channel. When a message asks you to click a link, open an attachment, transfer money, or paste a command, do not verify it inside that same message. Call the other party on a publicly listed number, or ask them in person. That habit beats any filter.

6. Write down what the first hour looks like. Who disconnects what, who gets notified, which machines must not be switched on again, and which backup can be brought back — write it on one page in advance. Deciding in the middle of an incident is how mistakes happen, such as rushing to pay a ransom or reinstalling and wiping evidence. The full discussion of whether to pay and how to return to work is in Articles 66 and 107 on this site, and is not repeated here.

The moment a suspicious message arrives: stop, verify, report

Many incidents start with one person and one click. When a suspicious message arrives, remember three words: stop, verify, report.

• Stop: Do not click the link, open the attachment, follow the message's instructions to paste any command, or hand over any verification code.
• Verify: Use a second, independent channel, such as calling the other company's publicly listed number or asking the sender directly. Do not verify using a phone number or link supplied inside the message itself, because that channel may itself be fake.
• Report: Tell the person in charge or the IT contact, so colleagues also know this kind of message is circulating. Do not just quietly delete it.

These three steps look simple, but against AI phishing messages that "look more genuine", they are precisely the effective defence: no matter how convincing the message reads, the second-channel verification step is very hard for the impersonator to fake as well.

How a company should prioritise: start with the most painful entry points

A small business cannot do everything at once, so prioritise like this:

• Secure the outward-facing entries first: Email, remote access, and a NAS exposed to the internet are the places automated scanning reaches most easily. The more you expose, the sooner updates and permissions need checking.
• Protect the most important data first: Customer data, financial records, and contracts should have their backup and restore verification at the front of the queue, not discovered to be broken only after an incident.
• Train the colleagues who face the outside world most: Staff who regularly receive supplier invoices and customer enquiries meet phishing messages most often. If they know "stop, verify, report", the whole company's risk already drops a long way.

In short, the NCSC warning is not telling Hong Kong small businesses to be afraid for two more years. It is telling them that AI makes attacks faster and more convincing, while the defences that hold remain the same basics: updates, multi-factor authentication, least privilege, offline backups plus restore testing, and second-channel verification. Those can be done today, without waiting until 2028.

Frequently asked questions