MITRE ATT&CK v20, Read Like Release Notes: New Entries on AI Abuse, MFA Workarounds and Attacks on Water Utilities
The latest version of MITRE ATT&CK, the widely used catalog of attacker behavior, adds techniques for prompt injection, abuse of a company’s own AI agents and theft of app passwords that skip MFA, plus new campaigns against water utilities. Here are the changes that matter to smaller businesses.
MITRE ATT&CK is the shared vocabulary security teams use to describe what attackers actually do once they go after a target. Many security tools map their alerts to it, and each update shows which attacker behaviors MITRE now considers worth tracking.
Version 20 came out last week. SecurityWeek summarized the update, and the entry names below come from MITRE’s October 2026 release page. We have arranged them like software release notes, with a line on why each one matters.
Added: AI as a target and a tool
- Direct Prompt Injection and Indirect Prompt Injection, two separate techniques: one for malicious instructions typed straight into an AI model, one for instructions hidden in documents, pages or data the model reads. Why it matters: any assistant that reads email, files or websites for you can be handed instructions by an outsider.
- AI-Enabled Exfiltration, covering attackers who use an organization’s own AI agents to pull data out. Why it matters: an agent with broad access to files and mailboxes is itself a doorway.
- AI Result Poisoning, a sub-technique for seeding web content to sway what AI search tools and assistants recommend. Why it matters: staff who ask an AI tool where to download software or which support number to call may get the attacker’s answer.
- A sub-technique SecurityWeek describes as disrupting AI-assisted analysis of malware. Why it matters: automated defenses can be targeted too, so human review still has a place.
Added: ways around the front door
- Steal Application Specific Passwords. These app passwords let a program sign in without an MFA prompt, which makes them valuable to thieves. Why it matters: MFA only protects what it actually covers.
- Anti-Automation Evasion, with sub-techniques for automatically solving CAPTCHA checks and for avoiding them. Why it matters: a CAPTCHA on a login or contact form slows bots down; it does not stop them.
Changed
- The sub-technique for compromised software dependencies and development tools moved to version 2.0 and now includes IDE and coding agent configuration files. Why it matters: the settings files for developers’ AI coding tools are now a recognized place to plant malicious changes.
- In the industrial (ICS) section, a single Command and Scripting Interpreter technique with sub-techniques for six interpreters replaces the older, now-deprecated Command-Line Interface and Scripting entries. Two new sub-techniques cover command-and-control traffic hidden in DNS and in publish/subscribe protocols.
New campaigns and groups
- An ICS campaign documenting attacks on internet-exposed programmable logic controllers at more than 30 water and wastewater utilities in Minnesota, which locked operators out of their systems. MITRE notes that attribution for the Minnesota intrusions “remains unconfirmed.”
- A campaign covering an AI-assisted breach of Mexican government institutions that crossed from IT into operational technology and reached a municipal water utility.
- New and updated groups: Nimbus Manticore, an espionage group associated with Iran’s IRGC that targets aerospace, defense and telecom organizations; Salt Typhoon’s entry now includes its exploitation of network edge devices; North Korea’s APT38 now reflects a move toward software supply chain attacks; and The Gentlemen, a ransomware-as-a-service operation.
Returned and new for mobile
- Deliver Malicious Application via Other Means, for apps installed from outside the official stores, is back after last appearing in version 11.
- NGate, malware that relays payment card data through a phone’s NFC chip so attackers can withdraw cash at ATMs, was added.
For defenders
The release includes 15 new detection strategies, six for enterprise IT and nine for industrial systems, backed by 38 analytics. MITRE designed the new industrial analytics to ignore routine engineering and maintenance work, which should help cut false alarms.
What this means for your company
You do not need to read all of ATT&CK to benefit from this release. Pick the handful of entries that match how your business works and turn them into questions for whoever manages your IT:
- Are app passwords and older sign-in methods that skip MFA turned off in our email and cloud accounts?
- Which AI assistants or agents can read our files, email or customer data, and who approved that access?
- Do our developers or contractors use AI coding tools, and are their configuration files reviewed like code?
- Is any equipment that controls physical systems, such as building controls, production lines or pumps, reachable from the internet?
- When our security tools raise an alert, can they tell us which ATT&CK technique it relates to, and does someone follow up?
Need help turning frameworks like ATT&CK into a short, practical to-do list for your business? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
