MITRE has released ATT&CK version 20, expanding the framework’s coverage of attacks involving artificial intelligence, authentication controls and industrial systems. According to SecurityWeek’s report on the release, MITRE described the update’s central goal as reflecting newer adversary behavior and tradecraft.
The Enterprise domain receives nine additions when techniques and sub-techniques are counted together. The update also introduces 15 detection strategies and 38 analytics, alongside new and revised entries for threat groups, industrial campaigns and mobile malware.
Prompt injection and abuse of organizational AI agents
ATT&CK v20 divides prompt injection into two techniques based on how malicious instructions reach a large language model. One covers instructions submitted directly through an LLM interface. The other addresses instructions embedded in material that a model subsequently processes.
That distinction gives defenders a way to separate attacks requiring direct interaction with a model from those delivered indirectly through documents, web pages or other ingested content.
Another technique describes adversaries abusing an organization’s own AI agents to obtain data. Additional sub-techniques cover manipulation of AI-dependent processes, including poisoning online content to alter recommendations produced by AI search and assistant systems, and interfering with malware analysis performed with LLM assistance.
These entries describe adversary behaviors rather than security properties that every AI system necessarily shares. Organizations can use them to map threat models and controls around prompts, retrieved content, agent permissions and AI-generated analytical output.
Authentication and bot protections receive new coverage
The Enterprise update adds a technique for stealing application-specific passwords. Such credentials can allow access without triggering the MFA prompt associated with an ordinary interactive sign-in.
CAPTCHA defenses are also represented through a new technique and two sub-techniques. One concerns automated CAPTCHA solving; the other covers avoiding the check altogether.
MITRE has also broadened the existing compromised-dependencies sub-technique to encompass configuration files used by integrated development environments and coding agents. The change reflects the security role of files that can influence development tools and AI-assisted coding workflows.
Together, MITRE says the additions improve ATT&CK’s representation of methods used to circumvent multi-factor authentication, bot checks and AI systems.
Industrial coverage includes attacks on water utilities
In the ICS domain, v20 records a campaign involving internet-exposed programmable logic controllers at more than 30 water and wastewater utilities in Minnesota. Operators were locked out of affected systems.
Reports have associated a broader wave of activity with Iranian-linked actors, but that does not establish responsibility for the Minnesota intrusions. MITRE’s position, quoted by SecurityWeek, is that attribution “remains unconfirmed.”
A separate campaign entry covers an AI-assisted compromise of Mexican government institutions across both IT and operational technology networks. The intrusion extended to a municipal water utility. It is documented separately from the Minnesota activity.
ATT&CK v20 also introduces Command and Scripting Interpreter for ICS, with sub-techniques covering six interpreters. It replaces the deprecated Command-Line Interface and Scripting techniques. Two further command-and-control sub-techniques address traffic concealed in DNS and in publish/subscribe protocols.
Detection content aims to reduce routine ICS noise
The release adds 15 detection strategies: six for Enterprise and nine for ICS. Across the update, MITRE added 38 analytics in total.
The new ICS analytics are designed to filter out normal engineering and maintenance operations. That matters in industrial environments, where legitimate administrative commands can resemble hostile activity and generate low-value alerts if operational context is ignored.
Security teams using ATT&CK mappings should review whether their detection content recognizes the newly documented techniques. AI-focused teams can map controls to direct and indirect prompt injection separately, while identity teams can account for application-specific passwords rather than treating every MFA bypass as the same behavior. ICS operators can compare the new analytics with expected maintenance and engineering workflows before using them for alerting.
Threat-group and mobile entries change
Version 20 adds Nimbus Manticore, described as an IRGC-associated espionage group targeting aerospace, defense and telecommunications organizations, together with information on its tools. It also introduces The Gentlemen, identified as a ransomware-as-a-service group.
Existing entries have been revised as well. The China-backed Salt Typhoon profile now covers exploitation of network-edge devices. The APT38 entry reflects a reported shift by the North Korean group from financial theft toward software supply-chain attacks.
In the Mobile domain, MITRE restored a technique for distributing malicious applications outside official app stores. It had last appeared in ATT&CK v11.
The update also adds NGate, malware that uses a phone’s NFC capability to relay payment-card data. That relay can enable attackers to make cash withdrawals from ATMs.
For organizations that use ATT&CK to structure threat models, detections or incident reports, the immediate task is to assess whether existing mappings overlook these newly represented behaviors—particularly indirect prompt injection, abuse of internal AI agents, application-specific password theft and command activity in industrial environments.
