MITRE ATT&CK v20: New AI Threats and How to Defend Against Them

On October 13, 2026, MITRE published version 20 of its ATT&CK framework. Most security teams use ATT&CK to describe attacker behavior and to measure their detection coverage. This release matters more than a routine update, because it adds the first Enterprise techniques aimed at AI systems, plus two real-world campaigns against water utilities and government networks. In this guide, we explain what changed, why it matters, and how to start detecting these behaviors in your own environment.

Table of Contents

1. What Is New in ATT&CK v20 at a Glance
2. The New AI Techniques in Enterprise
3. MFA Bypass and CAPTCHA Evasion
4. The Two New Campaigns
5. New ICS Techniques for Industrial Networks
6. Other Updates: Groups, Software and Mobile
7. How to Put ATT&CK v20 to Work: Practical Steps
8. Conclusion
9. FAQ

What Is New in ATT&CK v20 at a Glance

MITRE ATT&CK is a public knowledge base of tactics and techniques that adversaries use, based on real observations. Teams use it as a common language: a SOC analyst, a threat hunter, and a CISO can all say “T1566” and mean phishing.

Version 20 updates the Enterprise, Mobile, and ICS (industrial control systems) matrices. According to MITRE’s release notes, the Enterprise matrix now holds 227 techniques and 479 sub-techniques.

Here is the release in one table:

Area	What changed
Enterprise	9 new techniques and sub-techniques; major update to software supply chain compromise
ICS	New Command and Scripting Interpreter technique; two new command-and-control sub-techniques
Mobile	Brought back “Deliver Malicious Application via Other Means”; new tap-to-pay fraud malware
Campaigns	2026 U.S. Water Utilities Attacks; AI-Assisted Breach of Mexico’s Government Infrastructure
Defense	15 new detection strategies and 38 analytics

MITRE also plans ATT&CKcon 7.0 on October 27–28, 2026, and has already started work on v21, which it expects in April 2027.

The New AI Techniques in Enterprise

Five of the nine new Enterprise entries focus on AI. Until now, many teams mapped AI incidents to loosely related techniques. Now each behavior has its own ID, which makes reporting and detection engineering much easier.

Direct and Indirect Prompt Injection (T1699 and T1698)

Direct Prompt Injection (T1699) covers an attacker who types malicious instructions straight into an AI model’s interface. Think of a user who tells a company chatbot to ignore its rules.

Indirect Prompt Injection (T1698) is the harder problem. Here, the attacker hides instructions inside content the AI reads later: a web page, an email, a shared document, or a code file. The AI follows the hidden text because it cannot always tell data from commands.

Indirect injection scales well for attackers. They do not need access to your AI tool. They only need to place text where the tool will read it.

AI-Enabled Exfiltration (T1700)

This technique describes attackers who steer an enterprise AI agent into sending data out. The agent already has legitimate access to mail, files, and tickets. An attacker who controls its instructions can borrow that access, and the traffic looks like normal agent activity.

MITRE links this technique to both prompt injection types. An injected prompt tells the agent to collect sensitive data and send it to an outside address.

AI Result Poisoning (T1608.007)

This sub-technique sits under “Stage Capabilities.” Attackers manipulate web content so that AI search tools and assistants recommend something harmful, such as a fake download page or a malicious package name.

Marketing teams already know this tactic as a cousin of SEO manipulation. In security, the goal is different: steer a user (or an agent) to a trap.

Impair Autonomous Defenses (T1685.007)

Many SOCs now use LLMs to triage alerts and to analyze malware. This sub-technique, under “Disable or Modify Tools,” tracks attempts to disrupt that work. An attacker can plant text inside a malware sample or a log line that confuses the model, or that tells it to label the activity as harmless.

Developer Tooling Joins the Supply Chain Technique

MITRE also made a major update to T1195.001 (Compromise Software Dependencies and Development Tools). It now includes IDE and coding-agent configuration files. In plain terms, a poisoned config file in a repository can change how your coding assistant behaves.

MFA Bypass and CAPTCHA Evasion

The other Enterprise additions have nothing to do with AI, but they matter just as much for daily defense.

Steal Application Specific Passwords (T1697)

An application-specific password is a long, random password that a service generates for an older app, such as a mail client that cannot handle modern sign-in prompts. These passwords usually skip multi-factor authentication (MFA).

That convenience creates a gap. An attacker who phishes, generates, or harvests one of these passwords can log in without facing an MFA challenge. MITRE paired this technique with a new detection strategy, DET0926, which looks for suspicious acquisition and use of these passwords.

Anti-Automation Evasion (T1696)

This parent technique covers ways attackers get past bot checks. It has two sub-techniques:

• T1696.001, Automate CAPTCHA Completion: the attacker solves CAPTCHAs with software or paid solving services.
• T1696.002, Avoid CAPTCHA: the attacker finds a path that never triggers the check, for example a legacy API endpoint.

Defenders should care because CAPTCHAs often protect login pages, password reset forms, and sign-up flows. If attackers beat them at scale, credential stuffing and account abuse get cheaper.

The Two New Campaigns

ATT&CK defines a campaign as a group of intrusion activity over a set time, with shared targets and goals. Version 20 adds two that stand out.

C0066: 2026 U.S. Water Utilities Attacks

This campaign tracks activity that reached internet-facing programmable logic controllers (PLCs) across more than 30 water and wastewater utilities in Minnesota. The attackers locked operators out of their own systems. Nobody has formally attributed the activity.

The lesson is simple and uncomfortable. A PLC that faces the internet is a target, and many small utilities lack the staff to watch for this. Alongside the campaign, MITRE added software entry IOControl, malware linked to the CyberAv3ngers group that targets Linux-based IoT and OT devices, including PLCs, HMIs, and fuel management systems.

C0064: AI-Assisted Breach of Mexico’s Government Infrastructure

This one crosses IT and OT. According to MITRE’s campaign page, the intruder moved across several Mexican government institutions, including the federal tax authority, and reached a municipal water utility.

The attacker used an AI coding agent to scan servers, write exploit scripts, and automate collection and exfiltration. MITRE names Claude Code as the tool in its technique descriptions, and it maps the campaign to Direct Prompt Injection (T1699). MITRE also added the attacker’s toolkit, BACKUPOSINT v9.0 APEX PREDATOR, described as a 49-module Python toolkit generated with AI.

Two points stand out. First, AI let one operator cover a lot of ground quickly. Second, the same old weaknesses still opened the door: exposed servers and weak controls. AI sped up the attack; it did not invent new entry points.

New ICS Techniques for Industrial Networks

Industrial networks run on different tools than office networks, so ATT&CK for ICS has its own technique list. Version 20 makes two main changes.

T1701: Command and Scripting Interpreter

This new technique replaces two older ones, T0807 (Command-Line Interface) and T0853 (Scripting), which MITRE now marks as deprecated. It has six sub-techniques, so analysts can name the exact interpreter the attacker used:

ID	Interpreter
T1701.001	PowerShell
T1701.002	Windows Command Shell
T1701.003	Unix Shell
T1701.004	Visual Basic
T1701.005	Python
T1701.006	JavaScript

Each interpreter has its own detection strategy. For example, DET0929 covers PowerShell execution in ICS. The 22 new ICS analytics also filter out vendor software, engineering work, and approved maintenance, so alerts focus on activity outside your normal OT baseline.

Command and Control Over Familiar Protocols

Two new sub-techniques sit under T0869 (Standard Application Layer Protocol):

• T0869.001, DNS: the attacker hides command and control inside DNS traffic.
• T0869.002, Publish/Subscribe Protocols: the attacker uses messaging protocols that industrial networks already rely on.

Both work because defenders expect that traffic. Mitigation M1061 (Limit Software/Package Installation) also joins the list, which keeps unauthorized software off ICS assets.

Other Updates: Groups, Software and Mobile

Version 20 also updates threat intelligence and mobile coverage.

• NIMBUS MANTICORE (G1059): a new Iran-linked espionage group tied to the IRGC. It targets aerospace, defense, and telecom organizations. MITRE added 13 pieces of its software, including the MiniBike backdoor.
• Salt Typhoon (G1045): updated to cover exploitation of public-facing network edge devices at telecom providers.
• APT38 (G0082): updated to show its move from financial theft toward software supply chain attacks, including poisoned npm packages.
• The Gentlemen (G1058): a ransomware-as-a-service group with lockers for Windows, Linux, NAS, BSD, and ESXi.
• Vidar (S9050): a widely used Windows infostealer, often deployed alongside ransomware.
• Mobile: MITRE restored T1476, Deliver Malicious Application via Other Means, and added NGate, malware that relays tap-to-pay card data so attackers can withdraw cash at ATMs.

MITRE also describes “Agile” releases. In August, v19.2 added groups and software between the two yearly versions. Agile releases cover groups, software, and campaigns, but not techniques.

How to Put ATT&CK v20 to Work: Practical Steps

Reading the changelog is the easy part. The value comes from turning it into detections and controls. Below are five practical steps, each with code you can adapt.

Step 1: Load the v20 Data and Check Your Coverage Map

Use the official mitreattack-python library to read the new techniques. Download the Enterprise STIX bundle from the mitre-attack/attack-stix-data repository on GitHub first.

python3 -m venv attack-env && source attack-env/bin/activate
pip install mitreattack-python

from mitreattack.stix20 import MitreAttackData

data = MitreAttackData("enterprise-attack.json")

new_ids = ["T1699", "T1698", "T1700", "T1608.007",
           "T1685.007", "T1696", "T1696.001", "T1696.002", "T1697"]

for tid in new_ids:
    obj = data.get_object_by_attack_id(tid, "attack-pattern")
    if obj:
        print(f"{tid:<10} {obj.name}")
    else:
        print(f"{tid:<10} NOT FOUND - check you loaded the v20 file")

If you use ATT&CK Navigator, create a layer that highlights these techniques, then compare it with your detection rules:

{
  "name": "ATT&CK v20 - new Enterprise techniques",
  "versions": { "attack": "20", "navigator": "5.1.0", "layer": "4.5" },
  "domain": "enterprise-attack",
  "description": "Gap review for techniques added in v20",
  "techniques": [
    { "techniqueID": "T1699",     "color": "#4db2ec", "comment": "Direct Prompt Injection" },
    { "techniqueID": "T1698",     "color": "#4db2ec", "comment": "Indirect Prompt Injection" },
    { "techniqueID": "T1700",     "color": "#4db2ec", "comment": "AI-Enabled Exfiltration" },
    { "techniqueID": "T1608.007", "color": "#4db2ec", "comment": "AI Result Poisoning" },
    { "techniqueID": "T1685.007", "color": "#4db2ec", "comment": "Impair Autonomous Defenses" },
    { "techniqueID": "T1696.001", "color": "#4db2ec", "comment": "Automate CAPTCHA Completion" },
    { "techniqueID": "T1696.002", "color": "#4db2ec", "comment": "Avoid CAPTCHA" },
    { "techniqueID": "T1697",     "color": "#4db2ec", "comment": "Steal Application Specific Passwords" }
  ]
}

Step 2: Screen Content Before Your AI Tools Read It

You cannot stop every indirect injection, but you can flag the obvious ones. This simple script scans text files for hidden characters and common instruction phrases. Treat it as a first filter, not a complete defense.

#!/usr/bin/env python3
"""Flag possible hidden instructions in documents before an AI agent reads them."""
import re
import sys
from pathlib import Path

ZERO_WIDTH = re.compile(r"[\u200b\u200c\u200d\u2060\ufeff]")
HTML_COMMENT = re.compile(r"<!--(.*?)-->", re.S)
PATTERNS = [
    r"ignore (all )?(previous|prior|above) instructions",
    r"disregard (the )?(system|previous) (prompt|instructions)",
    r"you are now",
    r"send (this|the|all).{0,40}(to|via) (http|https|email|webhook)",
    r"do not (tell|inform|mention).{0,30}(user|human)",
]
RX = [re.compile(p, re.I) for p in PATTERNS]

def scan(path: Path) -> list[str]:
    text = path.read_text(errors="ignore")
    hits = []
    if ZERO_WIDTH.search(text):
        hits.append("zero-width characters present")
    for m in HTML_COMMENT.finditer(text):
        body = m.group(1)
        if any(r.search(body) for r in RX):
            hits.append(f"instruction-like HTML comment: {body.strip()[:80]!r}")
    for r in RX:
        if r.search(text):
            hits.append(f"pattern match: {r.pattern}")
    return hits

if __name__ == "__main__":
    for arg in sys.argv[1:]:
        for f in Path(arg).rglob("*"):
            if f.is_file() and f.suffix in {".txt", ".md", ".html", ".htm", ".eml", ".csv"}:
                findings = scan(f)
                if findings:
                    print(f"[!] {f}")
                    for item in findings:
                        print(f"    - {item}")

Run it like this: python3 scan_prompts.py ./inbox ./shared-docs

Beyond scanning, apply design rules. Give each AI agent the least access it needs. Block outbound requests to unknown domains. Require a human to approve any action that sends data outside the company.

Step 3: Hunt for App-Password Logins (T1697)

App passwords usually appear as legacy-protocol sign-ins that succeed without MFA. In Microsoft Entra ID, a KQL query over sign-in logs can surface them:

SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| where ClientAppUsed in ("IMAP4", "POP3", "SMTP Auth", "Other clients")
| where AuthenticationRequirement == "singleFactorAuthentication"
| summarize Logins = count(), IPs = dcount(IPAddress), Countries = dcount(tostring(LocationDetails.countryOrRegion))
          by UserPrincipalName, ClientAppUsed
| where IPs > 3 or Countries > 1
| order by Logins desc

The best fix is removal. Disable legacy protocols and app passwords where you can, and move users to modern authentication. If a legacy mail client must stay, restrict it by source IP.

Step 4: Find Exposed Industrial Devices on Your Own Network

Water utilities in C0066 lost control because PLCs faced the internet. Check your own ranges first. Run this only against networks you own or have written permission to test.

# Look for common industrial ports: S7comm 102, Modbus 502, DNP3 20000,
# EtherNet/IP 44818, BACnet 47808
sudo nmap -Pn -sT -p 102,502,20000,44818,47808 --open -oA ot-exposure 10.10.0.0/16

Then limit who can reach those ports. On a Linux gateway, allow only your engineering workstation to talk Modbus to the PLC network:

# Replace addresses with your own
iptables -A FORWARD -s 10.10.5.20 -d 10.20.0.0/24 -p tcp --dport 502 -j ACCEPT
iptables -A FORWARD -d 10.20.0.0/24 -p tcp --dport 502 -j DROP

Also remember that no PLC should accept a connection from the public internet. Put remote access behind a VPN with MFA.

Step 5: Watch for DNS Tunneling (T0869.001)

Long, random-looking DNS names often signal data hidden in queries. With tshark, you can scan a capture file for them:

tshark -r capture.pcap -Y "dns.flags.response == 0 && dns.qry.name.len > 50" \
  -T fields -e ip.src -e dns.qry.name | sort | uniq -c | sort -rn | head -20

In OT networks, DNS should be quiet and predictable. Any device that suddenly sends hundreds of unusual queries deserves a closer look.

A Short Checklist for Your Team

• Update your ATT&CK mappings to v20 and rerun your gap analysis.
• Inventory every AI agent, the data it can read, and the actions it can take.
• Remove app passwords and legacy authentication.
• Scan your IP ranges for exposed PLCs, HMIs, and remote access tools.
• Log DNS and messaging-protocol traffic in OT segments.
• Review IDE and coding-agent config files in your repositories like you review code.

Conclusion

ATT&CK v20 shows where attackers are going. They target AI agents, they borrow the access those agents hold, and they use AI to speed up routine intrusion work. At the same time, they still win with old weaknesses: exposed PLCs, passwords that skip MFA, and servers nobody patched.

For defenders, the plan is practical. Map the new techniques, find your gaps, and fix the basics first: remove legacy authentication, restrict industrial devices, and limit what AI tools can do on their own. Then add detections for prompt injection and data leaving through agents. ATT&CKcon 7.0 on October 27–28 will likely bring more detail, and v21 is due in April 2027.

Need help turning this into a real plan for your company? GEANTECHNOLOGY offers IT consulting and hands-on training in cybersecurity, Linux, and networkin