MITRE ATT&CK v20 adds AI abuse, MFA bypass and water utility campaigns

Past-week coverage · Original source published 2026-10-19.

MITRE has released version 20 of its ATT&CK framework, adding entries for AI abuse, MFA bypass and recent attacks on water utilities. The organization calls the biggest change "expanded coverage of recent adversary activity and tradecraft."

The Enterprise domain gets nine additions, counting techniques and sub-techniques. Prompt injection is now split into two techniques: malicious instructions typed directly into an LLM's interface, and instructions hidden in material the model ingests. Other entries cover attackers using an organization's own AI agents to steal data, poisoning web content to sway AI search and assistant recommendations, and disrupting LLM-assisted malware analysis.

On access, a new technique tracks theft of application-specific passwords that let attackers sign in without an MFA prompt. Another addresses CAPTCHA bypass, with sub-techniques for solving and avoiding bot checks. The compromised dependencies and development tools sub-technique now also covers IDE and coding agent configuration files.

In ICS, a new campaign documents attacks on internet-exposed PLCs at more than 30 water and wastewater utilities in Minnesota that left operators locked out. Some reports have linked the wider wave to Iranian-affiliated activity, but MITRE says attribution for the Minnesota intrusions "remains unconfirmed." A second campaign covers an AI-assisted breach of Mexican government institutions that spanned IT and OT and reached a municipal water utility.

Defenders get 15 new detection strategies backed by 38 analytics, with the ICS analytics designed to ignore routine engineering and maintenance work. MITRE also added threat actor Nimbus Manticore, an IRGC-associated espionage group targeting aerospace, defense and telecoms, and the ransomware-as-a-service group The Gentlemen. Salt Typhoon's entry now covers exploitation of network edge devices, and APT38's reflects a shift toward software supply chain attacks.

For defenders, the practical read is that the framework now names the paths attackers use to get around MFA and bot checks, and treats AI systems as targets in their own right. Teams mapping detections to ATT&CK can use the new analytics as a starting point, but should confirm coverage against their own telemetry rather than assuming the mappings fit.