Image: securityweek.com · rights & removal
Executive Summary
The release of MITRE ATT&CK v20 significantly expands the framework's coverage to reflect contemporary adversary tradecraft, with major additions in the Enterprise and Industrial Control System (ICS) domains. Noteworthy changes include dedicated tracking for AI abuse vectors such as prompt injection—differentiating between direct LLM interface instructions and those embedded in ingested material—and methods for utilizing organizational AI agents maliciously. Furthermore, defenses against bypassing Multi-Factor Authentication (MFA) via stolen application passwords and automated CAPTCHA solving have been formalized.
In the ICS domain, attention is drawn to specific real-world incidents, including attacks on over 30 water utilities in Minnesota affecting internet-exposed PLCs; MITRE maintains that attribution for these intrusions remains unconfirmed despite some speculation about Iranian affiliation. A separate campaign documented an AI-assisted breach impacting Mexican government infrastructure and a municipal water utility. The framework also consolidates command and control logging by replacing older techniques with more detailed interpreter classifications, while updates to actor profiles incorporate groups focusing on ransomware-as-a-service and shifts toward software supply chain compromises, such as APT38's new focus.
Facts Only
MITRE released version 20 of its ATT&CK framework.
The additions cover AI abuse, MFA bypass techniques, and recent attacks on water utilities.
Prompt injection is now tracked in Enterprise as two distinct techniques: malicious instructions entered into an LLM interface and instructions hidden within ingested material.
A technique was added detailing the use of an organization’s own AI agents for data theft.
New Enterprise techniques cover poisoning web content to sway AI search/assistant recommendations, and disrupting LLM-assisted malware analysis.
A new technique tracks the theft of application-specific passwords enabling sign-in without MFA prompts.
Bypassing CAPTCHA checks now has sub-techniques covering automatic solving and evasion.
The sub-technique for compromised software dependencies now includes IDE and coding agent configuration files.
In ICS, a new campaign documents attacks on internet-exposed PLCs at over 30 water/wastewater utilities in Minnesota, which locked out operators.
A second ICS campaign documented an AI-assisted breach across Mexican government IT and OT systems, reaching a municipal water utility.
ICS now includes the Command and Scripting Interpreter Technique with sub-techniques for six interpreters, replacing older methods.
New threat actor entries include Nimbus Manticore (IRGC-associated) and The Gentlemen (ransomware-as-a-service).
China-backed Salt Typhoon’s entry now covers exploitation of network edge devices.
North Korea’s APT38 entry reflects a shift from financial theft to software supply chain attacks.
Full Take
The systematic documentation of AI misuse within security frameworks represents a critical pivot in threat modeling, shifting defensive focus from perimeter defense to integrity maintenance across cognitive and operational layers. The ability of adversaries to inject malicious instructions into large language models—whether through prompt construction or data poisoning—challenges the fundamental assumption that input sanitization is sufficient; it requires validation of intent embedded within complex model inputs. This necessitates a new tier of risk assessment where adversarial action occurs not just *at* the system, but *within* the intelligence layer itself.
The divergence in actor behavior noted for APT38—a pivot from direct financial gain to supply chain subversion—mirrors a broader geopolitical trend: the increasing commoditization and weaponization of soft infrastructure. Ransomware-as-a-service operations like The Gentlemen indicate that sophistication is becoming decoupled from organizational maturity; attackers can monetize capabilities without needing deep penetration into an enterprise's specific environment. Similarly, the diverse industrial attacks across Minnesota highlight the vulnerability of traditionally siloed Operational Technology (OT) systems when exposure to internet-facing protocols increases, underscoring a systemic risk convergence between IT and OT that requires unified governance models.
The underlying paradigm driving these updates is the increasing blurring of technical boundaries: AI infiltrates application logic; credentials bypass multi-factor hurdles designed for physical access; and sophisticated state actors target global utility networks. The central assumption underpinning modern cybersecurity—that vulnerabilities can be patched or defenses configured against a known attack vector—is being undermined by emergent, contextual exploitation techniques.
What governance models are failing to adapt rapidly enough to categorize risks that exist at the conceptual level (i.e., influencing an AI's 'mind') rather than just the execution level? How does the rapid industrialization of offensive capabilities via RaaS influence national risk calculations when smaller actors possess high-leverage attack tools? Given the documented uncertainty in attribution for major infrastructure intrusions, what protocols must organizations adopt to manage reputational and regulatory exposure during active threat investigation?
Patterns detected: none
From the original · SecurityWeek
MITRE last week released version 20 of its ATT&CK framework, adding entries that cover AI abuse, MFA bypass, and recent attacks on water utilities. The organization says the biggest change in ATT&CK v20 is “expanded coverage of recent adversary activity and tradecraft.”Read the full story at securityweek.com
Sentinel — Human
This text functions as a straightforward technical bulletin summarizing major feature additions to MITRE ATT&CK v20. Its detailed sourcing and acknowledgment of unconfirmed attribution suggest human compilation rather than automated synthesis.