UK Cyber Chief Warns of AI Attack Surge as Groups Seek CISA Renewal

International cybersecurity officials and U.S. industry coalitions issued urgent warnings over AI-accelerated vulnerability exploitation, expiring federal threat-sharing authorities, cryptocurrency exchange breaches, and consumer hardware botnets on Monday evening.

UK Cyber Chief Richard Horne Warns of Unprecedented AI Attack Surge and Unveils Project DROMOS

As reported by The Record, UK National Cyber Security Centre (NCSC) CEO Richard Horne used his 2nd annual lecture at Mansion House in London to warn that Britain faces an "unprecedented rise" in cyberattacks over the coming months as frontier AI models automate software vulnerability discovery and exploit development:

• Project DROMOS, £70M NERV Centre & £60M Cyber Shield: Following Anthropic's Mythos Preview findings and 429 significant UK cyber incidents over the past year (up from 204 the prior year, including attacks affecting Marks & Spencer, Co-op, and Jaguar Land Rover), Horne announced Project DROMOS, an NCSC initiative with cloud providers and AI labs to automate vulnerability remediation at machine speed. Simultaneously, Chancellor of the Duchy of Lancaster Pat McFadden unveiled a £70 million National Early Warning and Response for Vulnerabilities (NERV) Centre and a £60 million Cyber Shield to protect UK public-sector networks (£130 million combined).

35 U.S. Business Groups Urge 10-Year CISA 2015 Renewal in FY27 NDAA

In Washington, CyberScoop reported that 35 major business and cybersecurity trade associations sent a joint letter Monday to 8 congressional committee leaders urging a clean 10-year reauthorization of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) attached to the fiscal year 2027 National Defense Authorization Act (NDAA):

• December 11 Expiration After 5 Short-Term Extensions: Originally enacted in 2015 to grant antitrust and liability protections to private companies sharing cyber threat indicators with the federal government, CISA 2015 expired at the end of September 2025 and has been kept alive through 5 short-term stopgap extensions, with the current authority expiring on December 11, 2026. Signatories—including the Alliance for Digital Innovation, Bank Policy Institute, Business Software Alliance, ** Edison Electric Institute**, and Information Technology Industry Council—warned that short-term extensions chill real-time threat sharing.

Mercado Bitcoin Halts Withdrawals After $46M Outflow; North Korea Denies $6B Binance Hack and Google Disrupts XCPE Botnet

Three major cybercrime and cryptocurrency enforcement developments also unfolded Monday:

• Brazil's Mercado Bitcoin Probes >$46M Outflow ($52.5M Total Estimate): According to The Record, Mercado Bitcoin—Brazil's largest cryptocurrency exchange, founded in 2013 with 4 million customers—suspended digital asset withdrawals after blockchain sleuth ZachXBT and security firms Cyvers and PeckShield flagged suspicious drains across Bitcoin, Ethereum, Solana, and BNB Chain totaling more than $46 million (with PeckShield estimating total losses at $52.5 million after stablecoin issuer Tether froze $4.5 million). Mercado Bitcoin stated that customer losses will be covered by corporate reserves and that Brazilian real (BRL) banking operations remain unaffected.
• North Korea Denies FBI Attribution for $6 Billion Binance Heist: As reported by KCBS Radio (via The Associated Press), Kim Yo Jong—sister of North Korean leader Kim Jong Un—issued a statement through state news agency KCNA dismissing the FBI's Friday attribution of the October 14, 2026 $6 billion Binance cryptocurrency heist to North Korean state hackers (TraderTraitor / Lazarus Group) as "a trite provocation." Binance CEO Richard Teng previously stated that the exchange recovered or froze roughly $3 billion (50%) of the stolen assets.
• Google GTIG Shuts Down 1.3M-Device Videostrong XCPE Botnet: Meanwhile, CyberScoop reported that the Google Threat Intelligence Group (GTIG), working with Cloudflare and ** Lumen Technologies**' Black Lotus Labs, sinkholed command-and-control domains and revoked Android signing certificates for the XCPE residential proxy botnet, which infected 1.3 million set-top boxes manufactured by Shenzhen Videostrong Technology across 209 countries and territories—including 547,000 devices in Brazil, 150,000 in Ukraine, and roughly 44,000 in the United States.