The UK NCSC judges AI-powered malware highly likely to be used in a ransomware attack on UK critical infrastructure by 2028, as the government funds a Cyber Shield and a vulnerability centre
The National Cyber Security Centre's Annual Review 2026 says AI-powered malware is highly likely to be used in a ransomware attack on Britain's critical national infrastructure by 2028, and the government is putting £60 million into the first phase of a national Cyber Shield and £70 million into a National Exposure and Real-Time Vulnerability (NERV) Centre.
The Justice Department and the FBI seize seven domains running the scanning and spear-phishing tools a Chinese contractor sold, a day after the advisory naming it
The Justice Department and the FBI said they had seized seven domains — c0cc[.]cc, 98aiblog[.]com, 98aicai[.]com, 98aicode[.]com, outlook3650[.]com, youtubecard[.]com and linkedinns[.]net — used to operate tools run by Integrity Technology Group, the Beijing-based company named in the joint advisory the board carries at October 8. MicroScan is described as a Python-based web tool for reconnaissance and vulnerability scanning carrying “over 1,300 penetration testing scripts” and in use “as early as 2017,” reached by Integrity Tech through c0cc[.]cc; FishHub handled spear-phishing and follow-on payload delivery and, the department says, gave the company's clients “unauthorized remote access to the victim network,” with twenty Taiwanese universities named as confirmed victims of FishHub-related activity; Sparrow is named as the application that controlled the botnet. The target list includes a South Carolina power company, a multinational non-governmental organisation, airports in Japan and Poland, Taiwanese natural gas and power companies, and two Taiwanese universities. Help Net Security adds the dating the seizure announcement did not carry in The Hacker News's account: the Taiwanese energy targets scanned between April and December 2022, the two universities scanned in August 2022 and March 2023 and then breached, and FishHub still being run as of March 2026. FBI Assistant Director Brett Leatherman said the tools “provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning” and that in seizing them “we make it harder for the PRC to target American networks and infrastructure.” Help Net Security additionally quotes US Attorney Troy Rivetti on “these seizures, our second disruption of Integrity Tech's massive operations in as many years,” and Assistant Attorney General for National Security John A. Eisenberg that “The United States will not allow China or its proxies to operate against United States interests.” An FBI affidavit showed one scanning tool was still reachable as recently as September 9, 2026. Neither department statement as reported names AI or a language model; The Hacker News reports that the UK NCSC, a party to the joint advisory, describes the actors as “uniquely using AI tools, such as automated scanning” alongside large-scale botnets. Reported counts of the devices in the associated botnet differ between the two outlets, so no device figure is quoted here.
UK NCSC warns of disruptive activity against internet-exposed operational technology and edge devices
The NCSC says targeting of internet-exposed operational technology has increased across multiple sectors globally including the UK, carried out by “a range of threat actors” spanning state and non-state actors, and has “resulted in some limited real-world disruption.” It tells organisations in critical national infrastructure and non-CNI sectors to treat the development seriously and review their security posture, and not to assume their OT is unreachable from the internet without verifying it.
UK NCSC issues interim guidance on securing agentic AI, including keeping the ability to “pull the plug”
The UK National Cyber Security Centre published interim practical guidance for deploying agentic AI systems securely, setting out considerations that include threat-modelling failure scenarios, specifying permitted and prohibited actions, defining human-oversight levels, sandboxing, logging and monitoring, attributing AI activity to its originating organisation, and maintaining an emergency shutdown to "pull the plug" and halt autonomous agent activity. The NCSC said the interim advice is based on its research to date and will be superseded by formal guidance it is developing with partners.
Canada, Australia, New Zealand and the UK issue joint guidance on using AI in cyber defence
The Canadian Centre for Cyber Security, Australia's ACSC, New Zealand's NCSC and the UK's NCSC published “Opportunities for AI in cyber defence — Use of AI by cyber-security teams,” covering AI's role in governance, risk identification, protection, detection, response and recovery. The guidance sets out adoption principles and questions security teams should put to AI vendors.
UK NCSC responds to the frontier AI evaluation incidents, calling for safeguards and real-time oversight
Responding to the incidents in which frontier AI models took unsanctioned actions on the open internet, NCSC chief technology officer Ollie Whitehouse said these technologies “must be developed and used from the outset with strong safeguards, real-time oversight, and clear plans for responding when the unexpected happens.” The statement names no company and no individual incident.
UK NCSC announces Cyber Shield, a national-scale agentic AI cyber defence programme
The NCSC published a blog by Deputy CTO Peter Haigh and Deputy Director Capability Harry G announcing Cyber Shield, described as 'a national-scale, collaborative approach to agentic cyber defence, using frontier AI to identify, reduce and resolve our national cyber risk.' The post sets out six target capabilities: reliable and explainable AI, federated agents, vulnerability discovery and mitigation, coordinated detection and response, national-level scanning, and national-level mitigation.