MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT ...

Not-for-profit organization MITRE has released details of version 20 of its ATT&CK framework, expanding its coverage of critical infrastructure threats, AI (artificial intelligence)-enabled attacks and cyber espionage. The update adds campaigns documenting attacks on more than 30 Minnesota water and wastewater utilities and an AI-assisted breach of Mexican government infrastructure that crossed information technology (IT) and operational technology (OT) environments, reaching a municipal water utility. MITRE also added new software entries, including CyberAv3ngers’ IOControl malware targeting Linux-based internet of things and OT devices, such as programmable logic controllers (PLCs), human-machine interfaces and fuel management systems.

On the defensive side, the update adds platform and asset context to industrial control systems detection strategies, helping security teams align detection approaches with specific assets, including engineering workstations and PLCs. The release includes 15 new detection strategies and 38 analytics across enterprise and industrial control systems environments, with industrial analytics designed to filter routine engineering and maintenance activity.

“ATT&CK v20 brings more critical infrastructure and cross-domain activity into the framework, with Campaigns for attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure that reached both IT and OT, along with new and updated Groups and Software tied to Iranian cyber espionage, Chinese and North Korean operations, and ransomware,” Amy L. Robertson wrote in a MITRE ATT&CK Medium blog post this week. “Enterprise gains AI-focused and AI-enabled Techniques, ICS added Techniques for command and script execution and command and control over protocols industrial networks already use, and Mobile un-deprecated a Technique for delivering malicious apps outside official stores.”

For ICS, ATT&CK v20 has two new Campaigns, the 2026 U.S. water utility attacks and the IT/OT breach of Mexican government infrastructure. There are also two new pieces of Software, CyberAv3ngers’ IOControl and the AI-generated toolkit from the Mexico breach, along with a Command and Scripting Interpreter Technique with six Sub-Techniques and two new command and control Sub-Techniques, so ICS mappings can align to the specific interpreter or protocol an adversary used.

The new Campaign C0066: 2026 U.S. Water Utilities Attacks tracks adversarial activity that has not been formally attributed. The activity reached internet-facing PLCs across more than 30 Minnesota water and wastewater utilities and locked operators out of their own systems. C0064: AI-Assisted Breach of Mexico’s Government Infrastructure is a cross-domain Campaign spanning IT and OT, in which intruders moved across Mexican government institutions and reached a municipal water utility.

Two pieces of Software were also added. S9046: IOControl is G1027: CyberAv3ngers’ malware for Linux-based IoT and OT devices, including PLCs, Human-Machine Interfaces (HMIs), and fuel management systems. S9045: BACKUPOSINT v9.0 APEX PREDATOR is the AI-generated, 49-module Python toolkit used in the Mexico breach.

In addition, Robertson detailed that T1701: Command and Scripting Interpreter was added to ICS, with Sub-Techniques for T1701.001: PowerShell, T1701.002: Windows Command Shell, T1701.003: Unix Shell, T1701.004: Visual Basic, T1701.005: Python, and T1701.006: JavaScript. It replaces T0807: Command-Line Interface and T0853: Scripting, both now deprecated, so ICS mappings can show which interpreter an adversary used.

For Cyber Threat Intelligence (CTI), the release adds G1059: NIMBUS MANTICORE, an Iran-linked, Islamic Revolutionary Guard Corps (IRGC)-associated espionage group that targets aerospace, defense, and telecommunications organizations. It also includes 13 pieces of the group’s Software, such as the S9059: MiniBike backdoor and its S9060: MiniBus, S9053: MiniJunk, and S9052: MiniFast successors.

Two existing groups were updated. G1045: Salt Typhoon, the People’s Republic of China (PRC)-linked group behind compromises of major telecom providers, now covers its exploitation of public-facing network edge devices. The Democratic People’s Republic of Korea (DPRK)-backed G0082: APT38 now reflects its move from financial theft into software supply chain compromises, including poisoned npm packages.

On the criminal side, G1058: The Gentlemen run S9051: The Gentlemen Ransomware, a RaaS with lockers for Windows, Linux, NAS, BSD, and ESXi, covering network-attached storage (NAS) and ESXi hosts as well as endpoints. The release also adds S9050: Vidar, a Windows infostealer often deployed alongside ransomware and cryptominers.

“In August we released v19.2 , our first Agile release for CTI, bringing G1057: ShinyHunters, G1056: TeamPCP, and the S9008: Shai-Hulud family into ATT&CK to ensure defenders could prepare for and respond to them faster,” Robertson said. “Adversaries don’t wait for our release windows, and Agile releases let us publish Groups, Software, and Campaigns (but not Techniques) when significant activity breaks between biannual versions. We’ll keep doing these agile releases between the cycles, and if you have a rapid release suggestion, let us know.”

For Enterprise, ATT&CK v20 has nine new Techniques and Sub-Techniques covering prompt injection, AI-enabled exfiltration, AI result poisoning, attacks on AI-assisted defenses, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) evasion, and application-specific password theft. A supply chain update also reaches into developer tooling, so mappings can capture how adversaries get around Multi-Factor Authentication, bot checks, and AI systems.

Robertson mentioned that Detection Strategies (DETs) have covered Enterprise, Mobile, and ICS since v18. In v20, they were tailored to what defenders can see in each domain. ICS DETs now name the platforms they apply to (Windows, Linux, Network Devices, and Embedded) and the Assets they target, so defenders can tell whether a strategy fits an engineering workstation, a PLC, or both. Mobile DETs account for what Android and iOS expose, separating what can be monitored continuously from what is seen only under certain conditions, through device management, or in a forensic review. In all three domains, each DET now links an adversary behavior to the data that can be collected for it and the Analytics that use that data.

For this release, six Detection Strategies were written for Enterprise and nine for ICS, backed by 38 Analytics . In ICS, each new interpreter has its own strategy, from DET0929: Behavioral Detection of PowerShell Execution in ICS to DET0930: Behavioral Detection of Windows Command Shell Execution in ICS. The 22 new ICS Analytics are tuned to set aside vendor software, engineering workflows, and approved maintenance, so alerts focus on execution outside the OT baseline. In Enterprise, DET0926: Suspicious Acquisition and Use of Application-Specific Passwords pairs with the new MFA bypass Technique. Ten Data Components were also updated across all three domains.

For Defense, the release adds Platform and Asset context for ICS DETs, and Mobile DETs that reflect what Android and iOS let defenders see. It also includes 15 new DETs and 38 Analytics for this release’s behaviors, with ICS Analytics tuned to filter out routine engineering and maintenance activity.

For Mobile, the release restores a previously deprecated Technique for delivering malicious apps outside official stores, adds malware that relays tap-to-pay card data to an adversary for ATM cash-outs, and includes 28 revised Software entries.