MITRE ATT&CK v20 adds AI abuse and water attacks

MITRE released ATT&CK v20 on 13 October 2026. The update adds two real-world campaigns, nine new Enterprise techniques and sub-techniques and a set of detection strategies. Five of the new techniques cover attacks on and through AI systems. If your team maps detections to ATT&CK, this release changes what you can map.

Everything about v20 below comes from MITRE’s own update page, its changelog and the new entries on attack.mitre.org. Where MITRE describes an event, we say that MITRE does.

What changed in ATT&CK v20?

MITRE says the biggest change is wider coverage of recent adversary activity. It names two new campaigns, AI-focused techniques in Enterprise, and execution and command and control techniques in ICS, the industrial control system matrix. It also brings back a Mobile technique, Deliver Malicious Application via Other Means, last seen in v11.

ICS detection strategies now carry platform and asset context. Each ICS strategy now lists the platforms and asset types it is meant for, such as workstations, HMIs or network devices. The changelog lists nine new ICS detection strategies and 205 new ICS analytics.

What do the new AI techniques describe?

The Enterprise matrix now has several AI-related entries, spread across different tactics. Some of the new entries target what a model reads. Others use an AI system to reach data or to mislead its users. The prompt injection in AI agents page covers the defender side in more detail.

The poisoning technique is the one buyers may not expect. MITRE contrasts it with classic search poisoning: the target is an AI tool that writes a direct answer, not a ranked list of links. It notes that such content can look like ordinary marketing, so prompt injection and malware detections may miss it.

Which real attacks did MITRE add?

The first is C0066, the 2026 U.S. Water Utilities Attacks. MITRE describes a campaign against more than 30 municipal water and wastewater utilities in Minnesota, starting on 27 July 2026. It cites FBI and EPA reporting of similar activity in at least seven states.

The intruders reached internet-facing Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 controllers through cellular gateways. They changed IP addresses and passwords to lock operators out. MITRE says at least one controller program was altered, and one utility took its treatment plant offline. The campaign is not formally attributed.

The second is C0064, an AI-assisted breach of Mexican government infrastructure. MITRE says human operators used commercial AI tools for reconnaissance, exploitation, privilege escalation, credential harvesting and exfiltration. The breach hit several government institutions and a municipal water utility. MITRE warns that public reporting gives only select details, so the entry is not complete.

In the ICS matrix, MITRE also added T1701 Command and Scripting Interpreter with six sub-techniques, and two new command and control sub-techniques for DNS and publish/subscribe protocols. It deprecated the older T0807 and T0853 entries. MITRE does not link the water campaign to a named group. Our CyberAv3ngers profile covers an earlier group that attacked industrial controllers, a useful comparison for OT teams.

What changed for MFA bypass and supply chain?

T1697 Steal Application Specific Passwords is new. MITRE defines these passwords as credentials for third-party apps or older devices that cannot use multi-factor authentication. An attacker can phish one, generate one on a hacked account, or find one stored on a system. The password then bypasses MFA. A matching detection strategy, DET0926, ships with it.

Another new technique, T1696 Anti-Automation Evasion, covers ways to pass bot checks. Its two sub-techniques are Automate CAPTCHA Completion and Avoid CAPTCHA. For session theft and other sign-in tricks, our device-code phishing article shows how attackers get around MFA without breaking it.

MITRE also gave T1195.001, Compromise Software Dependencies and Development Tools, a major update. It now covers configuration and instruction files used by development environments and AI coding agents. Our software supply chain technique page covers the neighbouring technique for compromised software builds. Two group profiles also got major revisions. MITRE revised APT38 to cover software supply chain compromises, and Salt Typhoon to cover public-facing network edge devices.

The release also adds two groups. NIMBUS MANTICORE is described as a state-sponsored espionage group tied to Iran’s IRGC and active since 2021. The Gentlemen runs a ransomware-as-a-service operation that was first seen in mid-2025 and opened to affiliates in September 2025.

What does this mean for detection teams?

ATT&CK does not tell you what to buy or fix. It gives a shared vocabulary. The practical effect is on coverage maps: once a map moves to v20, the new techniques show as gaps until detections are mapped to them. The questions below come from the facts above. They are not recommendations from MITRE.

MITRE also lists ATT&CKcon 7.0 for 27 and 28 October 2026 in McLean, Virginia.