MITRE ATT&CK v20 Adds AI Abuse, MFA Bypass and Water Utility Attacks
Summary
MITRE ATT&CK v20 adds coverage of AI abuse, MFA bypass, attacks on water utilities, threat actors and mobile malware, alongside 15 new detection strategies backed by 38 analytics.
Key points
- Enterprise additions cover prompt injection, AI-agent data theft, manipulated AI recommendations, disrupted AI-assisted malware analysis, application-specific password theft and CAPTCHA bypass.
- A new ICS campaign tracks attacks on internet-exposed PLCs at more than 30 Minnesota water and wastewater utilities, whose operators were locked out; attribution remains unconfirmed.
- Another ICS campaign documents an AI-assisted breach of Mexican government institutions spanning IT and OT and reaching a municipal water utility.
- ICS adds interpreter and command-and-control techniques, including DNS and publish/subscribe protocol sub-techniques.
- MITRE added the IRGC-associated Nimbus Manticore group and updated entries for Salt Typhoon and APT38; it also added ransomware-as-a-service group The Gentlemen.
- Defenders get 15 new detection strategies backed by 38 analytics, including ICS analytics designed to filter routine engineering and maintenance work.
- Mobile coverage again includes malicious apps delivered outside official stores and adds NGate, malware that relays payment card data over a phone’s NFC for ATM cash withdrawals.
Article Details
- Event Type
- MITRE released version 20 of the ATT&CK framework, adding coverage for AI abuse, MFA bypass, attacks on water utilities, and other adversary techniques and activity.
- Impact
- The update expands documented Enterprise, ICS, and Mobile techniques and sub-techniques, adds detection strategies and analytics, and records attacks affecting water utilities and Mexican government institutions. MITRE says attribution for the Minnesota water-utility intrusions remains unconfirmed.
Threat Actors
APT38Described as North Korean; its MITRE entry reflects a shift from financial theft to software supply chain attacks.Nimbus ManticoreAn IRGC-associated espionage group targeting aerospace, defense, and telecoms organizations, according to the article.Salt TyphoonDescribed as China-backed; MITRE's entry now covers its exploitation of network edge devices.The GentlemenA group running a ransomware-as-a-service operation, according to the article.
Malware
Countries
ChinaChina-backed Salt Typhoon’s entry now covers its exploitation of network edge devices, while the entry for North Korea’s APT38 reflects a shift from financial theft to software supply chain attacks.MinnesotaIn ICS, a new campaign tracks attacks on internet-exposed PLCs at more than 30 water and wastewater utilities in Minnesota, which left operators locked out of their systems.North KoreaChina-backed Salt Typhoon’s entry now covers its exploitation of network edge devices, while the entry for North Korea’s APT38 reflects a shift from financial theft to software supply chain attacks.
Industries
AerospaceOn the threat actor front, MITRE added Nimbus Manticore, an IRGC-associated espionage group targeting aerospace, defense, and telecoms organizations, along with its tools.DefenseOn the threat actor front, MITRE added Nimbus Manticore, an IRGC-associated espionage group targeting aerospace, defense, and telecoms organizations, along with its tools.GovernmentA second campaign documents an AI-assisted breach of Mexican government institutions that spanned IT and OT and reached a municipal water utility.Water and wastewater utilitiesIn ICS, a new campaign tracks attacks on internet-exposed PLCs at more than 30 water and wastewater utilities in Minnesota, which left operators locked out of their systems.