# NCSC: AI to amplify UK cyber threat by 2025

Published: 2024-01-24 · Severity: high · Sectors: government-national, financial-services, healthcare, energy, defense, education, manufacturing, telecommunications, transportation, retail, technology, infrastructure
Canonical: https://vorant.io/reports/c11a40ac-da1c-5687-a340-31050869d13f/ncsc-ai-to-amplify-uk-cyber-threat-by-2025

> The UK's National Cyber Security Centre assesses that AI will almost certainly increase cyber attack volume and impact through 2025, primarily via enhanced social engineering and reconnaissance.

The UK National Cyber Security Centre has published a formal intelligence assessment concluding that artificial intelligence will almost certainly increase both the volume and impact of cyber attacks against the UK over the next two years. The assessment finds that all categories of threat actors—state and non-state, skilled and novice—are already incorporating AI into operations, with the most significant capability uplift occurring in reconnaissance and social engineering. Generative AI models enable convincing phishing content without the telltale translation and grammatical errors that historically revealed malicious emails, while AI's ability to rapidly analyze exfiltrated data will enhance the value extracted from successful intrusions.

The threat landscape impact will be uneven. Less sophisticated actors will gain the most relative benefit, as publicly available AI models lower barriers to effective access operations and information gathering, likely contributing to the global ransomware threat. More advanced applications—such as AI-generated malware trained on quality exploit data or accelerated vulnerability research—will remain restricted to highly capable state actors with significant resources, expertise, and training data repositories through 2025. The NCSC warns that the commoditization of AI-enabled tools through criminal-as-a-service models will almost certainly make improved capabilities available to any actor willing to pay, intensifying cyber resilience challenges for both government and private sector organizations.

## Detection guidance (public sample)

### Office Application Spawning Script Interpreter or Command Shell (Phishing Attachment Execution)

ATT&CK: T1204

Detects Office applications (Word/Excel/PowerPoint) launching script interpreters or shells, a common pattern when a user opens a malicious spearphishing attachment that triggers macro execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or Shell
id: a171ba24-8bed-5eab-a63c-18371b1ec103
status: experimental
description: Detects Microsoft Office applications spawning command shells or script
  interpreters, consistent with a user executing a malicious macro/attachment delivered
  via spearphishing.
references:
- https://www.ncsc.gov.uk
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
  filter:
    CommandLine|contains:
    - Normal.dotm
    - \Templates\
  condition: selection and not filter
falsepositives:
- Legitimate document automation or add-ins that call scripting engines for approved
  business workflows
- IT-deployed macro-based templates that invoke PowerShell for internal reporting
level: medium
tags:
- attack.t1204
- attack.t1566.001
- attack.execution
author: Vorant
```

### Mass File Rename with Ransom Note Creation (Data Encrypted for Impact)

ATT&CK: T1486

Detects rapid creation of ransom note files alongside renamed/encrypted files in user or shared directories, indicating a ransomware encryption event following successful phishing-based initial access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mass File Rename with Ransom Note Creation
id: 867be24c-2cfa-5d9f-b976-7cd92c2addda
status: experimental
description: Detects file system activity consistent with ransomware encryption routines,
  including creation of files with ransom-note-like names in multiple directories
  in a short period. Analysts should correlate with a threshold of many such events
  across distinct paths within a short window to confirm mass encryption rather than
  a single note.
references:
- https://www.ncsc.gov.uk
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - README
    - DECRYPT
    - HOW_TO_
    - RECOVER
    - RESTORE_FILES
    TargetFilename|endswith:
    - .txt
    - .html
    - .hta
  condition: selection
falsepositives:
- Legitimate software installers or documentation that place README/RESTORE files
  in application directories
- Backup or recovery tools that create similarly named instructional files
level: high
tags:
- attack.t1486
- attack.impact
author: Vorant
```

### Suspicious PowerShell Inbox Rule Creation for Mail Redirection (Internal Spearphishing Enablement)

ATT&CK: T1534

Detects use of PowerShell Exchange cmdlets to create or modify inbox/mail-flow rules that forward, redirect, or auto-reply to messages, a technique used after account compromise to enable internal spearphishing or conceal further phishing traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell Mailbox Rule Creation for Internal Mail Redirection
id: 39f3881e-0a4f-51aa-b00d-1206a43e8835
status: experimental
description: Detects PowerShell commands invoking Exchange cmdlets such as New-InboxRule
  or Set-Mailbox with forwarding/redirect parameters, commonly abused after account
  takeover to enable internal spearphishing or exfiltrate mail.
references:
- https://www.ncsc.gov.uk
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - New-InboxRule
    - Set-InboxRule
    - New-TransportRule
  selection_forward:
    CommandLine|contains:
    - ForwardTo
    - RedirectTo
    - ForwardAsAttachmentTo
    - DeleteMessage
  condition: selection and selection_forward
falsepositives:
- IT administrators legitimately configuring mail-flow rules or shared mailbox forwarding
  for approved business purposes
- Scripted automation for helpdesk-managed mailbox delegation
level: medium
tags:
- attack.t1534
- attack.collection
- attack.persistence
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c11a40ac-da1c-5687-a340-31050869d13f/ncsc-ai-to-amplify-uk-cyber-threat-by-2025.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup