MITRE ATT&CK v20 adds new techniques for AI attacks and critical infrastructure breaches

MITRE released version 20 of its ATT&CK framework this week, expanding its catalog of adversary behaviors. The update focuses heavily on artificial intelligence threats and critical infrastructure, according to Industrial Cyber. This version adds specific campaign data and new technical entries to help security teams track evolving attacks.

The release incorporates details on attacks targeting more than 30 water and wastewater utilities in Minnesota. It also documents an AI-assisted breach of Mexican government infrastructure that bridged information technology and operational technology environments. These additions provide visibility into how threat actors are crossing traditional security boundaries to reach municipal services.

Expanded Coverage of AI and Industrial Protocols

MITRE added new software entries to the framework, including IOControl malware from the CyberAv3ngers group. This malware targets Linux-based internet of things and operational technology devices, such as programmable logic controllers and fuel management systems. The update also introduces techniques to track command execution and command-and-control activity across industrial networks.

The framework now covers the abuse of DNS and publish/subscribe protocols in industrial settings. On the enterprise side, new techniques address prompt injection, AI-enabled data exfiltration, and AI result poisoning. These additions help defenders understand how attackers leverage artificial intelligence to bypass defenses and steal data.

Defensive Improvements and Campaign Details

The update adds platform and asset context to detection strategies for industrial control systems. Security teams can now align their detection approaches with specific assets like engineering workstations and PLCs. The release includes 15 new detection strategies and 38 analytics for both enterprise and industrial environments, designed to filter routine maintenance activity.

Amy L. Robertson, writing in a MITRE ATT&CK blog post, noted the inclusion of campaigns tied to Iranian, Chinese, and North Korean operations. The framework also un-deprecated a mobile technique for delivering malicious apps outside official stores. These changes reflect a broader effort to capture cross-domain activity and emerging threat actor tactics.

What should you do?

Security professionals should review the new ATT&CK v20 entries to identify gaps in their current detection rules. Teams managing critical infrastructure should specifically examine the new industrial control system analytics. Organizations using AI tools should assess their exposure to prompt injection and data exfiltration techniques listed in the update.

Background: Prompt injection attacks

Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.

Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

What to do and how to stay safe: MITRE

• Map the new IOControl malware indicators to your existing security information and event management systems.
• Review command-and-control rules to ensure they detect abuse of DNS and publish/subscribe protocols in OT networks.
• Audit AI-integrated applications for vulnerabilities related to prompt injection and result poisoning.
• Update asset inventories to include engineering workstations and PLCs in your industrial control system monitoring scope.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What new campaigns are included in ATT&CK v20?

The framework adds campaigns for attacks on Minnesota water utilities and an AI-assisted breach of Mexican government infrastructure.

Does this update cover artificial intelligence threats?

Yes, it adds techniques for prompt injection, AI-enabled data exfiltration, AI result poisoning, and attacks on AI-assisted defenses.

Which industrial devices are targeted by the new software entries?

The update includes IOControl malware targeting Linux-based OT devices such as programmable logic controllers and human-machine interfaces.