ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber

ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber EspionageATT&CK v20 brings more critical infrastructure and cross-domain activity into the framework, with Campaigns for attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure that reached both IT and OT, along with new and updated Groups and Software tied to Iranian cyber espionage, Chinese and North Korean operations, and ransomware. Enterprise gains AI-focused and AI-enabled Techniques, ICS added Techniques for command and script execution and command and control over protocols industrial networks already use, and Mobile un-deprecated a Technique for delivering malicious apps outside official stores. On the defensive side, ICS Detection Strategies (DETs) now carry platform and Asset context, tying behaviors to the operational role of each system, and Mobile DETs reflect the visibility limits of Android and iOS.Here’s what’s in v20:ICS: Two Campaigns, the 2026 U.S. water utility attacks and the IT/OT breach of Mexican government infrastructure; two new pieces of Software, CyberAv3ngers’ IOControl and the AI-generated toolkit from the Mexico breach; and Command and Scripting Interpreter with six Sub-Techniques plus two new command and control Sub-Techniques, so ICS mappings can align to the specific interpreter or protocol an adversary used.Cyber Threat Intelligence (CTI): Iran-linked NIMBUS MANTICORE and 13 pieces of its espionage toolkit; updates to People’s Republic of China (PRC)-backed Salt Typhoon on its exploitation of edge devices at telecom providers and to North Korea’s APT38 on its software supply chain compromises; and The Gentlemen’s ransomware, locks ESXi hosts and network-attached storage (NAS) as well as endpoints., plus the Vidar infostealer.Enterprise: Nine new Techniques and Sub-Techniques for prompt injection, AI-enabled exfiltration, AI result poisoning, attacks on AI-assisted defenses, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) evasion, and application-specific password theft, plus a supply chain update that reaches into developer tooling, so mappings can capture how adversaries get around Multi-Factor Authentication, bot checks, and AI systems.Defense: Platform and Asset context for ICS DETs, Mobile DETs that reflect what Android and iOS let defenders see, and 15 new DETs and 38 Analytics for this release’s behaviors, with ICS Analytics tuned to filter out routine engineering and maintenance activity.Mobile: An un-deprecated Technique for delivering malicious apps outside official stores, malware that relays tap-to-pay card data to an adversary for ATM cash-outs, and 28 revised Software entries.You’ll find the full details in the release notes, detailed changelog, and changelog.json.ICS | Water Utility and Government Breaches, New OT Malware, and Execution and Command & Control TechniquesThe new Campaign, C0066: 2026 U.S. Water Utilities Attacks tracks adversarial activity, that hasn’t been formally attributed, reaching internet-facing Programmable Logic Controller (PLCs) across more than 30 Minnesota water and wastewater utilities and locking operators out of their own systems. C0064: AI-Assisted Breach of Mexico’s Government Infrastructure is a cross-domain Campaign, spanning IT and OT, with intruders moving across Mexican government institutions and reaching a municipal water utility.We also added two pieces of Software, S9046: IOControl a G1027: CyberAv3ngers’ malware for Linux-based IoT and OT devices, including PLCs, Human-Machine Interface (HMIs), and fuel management systems, and S9045: BACKUPOSINT v9.0 APEX PREDATOR, the AI-generated, 49-module Python toolkit used in the Mexico breach.Additionally, T1701: Command and Scripting Interpreter was added to ICS, with Sub-Techniques for T1701.001: PowerShell, T1701.002: Windows Command Shell, T1701.003: Unix Shell, T1701.004: Visual Basic, T1701.005: Python, and T1701.006: JavaScript. It replaces T0807: Command-Line Interface and T0853: Scripting, both now deprecated, so ICS mappings can show which interpreter an adversary used.New T0869.001: DNS and T0869.002: Publish/Subscribe Protocols Sub-Techniques under T0869: Standard Application Layer Protocol capture adversaries hiding command and control in protocols industrial networks already rely on, and M1061: Limit Software/Package Installation addresses keeping unauthorized software off of ICS assets.Enterprise | MFA Bypass, Developer Tooling, and AIT1697: Steal Application Specific Passwords tracks adversaries who phish, generate, or harvest application-specific passwords to log in without facing MFA. T1696: Anti-Automation Evasion, with Sub-Techniques T1696.001: Automate CAPTCHA Completion and T1696.002: Avoid CAPTCHA, addresses ways adversaries get past bot checks. We also gave T1195.001: Compromise Software Dependencies and Development Tools a major update to include IDE and coding agent configuration files.This release also adds AI-focused and AI-enabled Techniques. T1699: Direct Prompt Injection and T1698: Indirect Prompt Injection describe malicious prompts entered into an LLM’s interface or embedded in content it processes. T1700: AI-Enabled Exfiltration captures how adversaries may direct enterprise AI agents to exfil data, and T1608.007: Stage Capabilities: AI Result Poisoning captures the manipulation of web content to influence what AI search and assistants recommend. T1685.007: Disable or Modify Tools: Impair Autonomous Defenses tracks attempts to disrupt LLM-assisted analysis of malware and activity.Cyber Threat Intelligence | Iranian Espionage, PRC and DPRK Operations, and RansomwareWe added G1059: NIMBUS MANTICORE, an Islamic Revolutionary Guard Corps (IRGC)-associated espionage group that targets aerospace, defense, and telecommunications organizations. We also included 13 pieces of its Software, such as the S9059: MiniBike backdoor and its S9060: MiniBus, S9053: MiniJunk, and S9052: MiniFast successors.G1045: Salt Typhoon, the PRC-linked group behind compromises of major telecoms providers, received an update covering its exploitation of public-facing network edge devices. The Democratic People’s Republic of North Korea’s (DPRK)-backed G0082: APT38 now reflects its move from financial theft into software supply chain compromises, including poisoned npm packages.On the criminal side, G1058: The Gentlemen (not really gentlemen) run S9051: The Gentlemen Ransomware, a RaaS with lockers for Windows, Linux, NAS, BSD, and ESXi. We also added S9050: Vidar, a widely used Windows infostealer often deployed alongside ransomware and cryptominers.Going AgileIn August we released v19.2, our first Agile release for CTI, bringing G1057: ShinyHunters, G1056: TeamPCP, and the S9008: Shai-Hulud family into ATT&CK to ensure defenders could prepare for and respond to them faster. Adversaries don’t wait for our release windows, and Agile releases let us publish Groups, Software, and Campaigns (but not Techniques) when significant activity breaks between biannual versions. We’ll keep doing these agile releases between the cycles, and if you have a rapid release suggestion, let us know.Defense | ICS Asset Context, Mobile Visibility, and New Detection StrategiesDetection Strategies (DETs) have covered Enterprise, Mobile, and ICS since v18. In v20, we tailored them to what defenders can see in each domain. ICS DETs now name the platforms they apply to (Windows, Linux, Network Devices, and Embedded) and the Assets they target, so you can tell whether a strategy fits an engineering workstation, a PLC, or both. Mobile DETs account for what Android and iOS expose: they separate what you can monitor continuously from what you only see under certain conditions, through device management, or in a forensic review. In all three domains, each DET now links an adversary behavior to the data you can collect for it and the Analytics that use that data.For this release, we wrote six Detection Strategies for Enterprise and nine for ICS, backed by 38 Analytics. In ICS, each new interpreter has its own strategy, from DET0929: Behavioral Detection of PowerShell Execution in ICS to DET0930: Behavioral Detection of Windows Command Shell Execution in ICS, and the 22 new ICS Analytics are tuned to set aside vendor software, engineering workflows, and approved maintenance, so alerts focus on execution outside the OT baseline. ICS Detection Strategies now list the platforms they apply to, Windows, Linux, Network Devices, and Embedded, so defenders can match each strategy to the assets it covers. In Enterprise, DET0926: Suspicious Acquisition and Use of Application-Specific Passwords pairs with the new MFA bypass Technique. We also updated ten Data Components across all three domains.Mobile | Deliver Malicious Application via Other Means and Tap-to-Pay Card FraudWe brought back T1476: Deliver Malicious Application via Other Means, last seen in v11, and rewrote it for how malicious apps reach phones today: direct APK downloads, links sent over SMS, messaging apps, and QR codes, and third-party app stores. With the Technique back, we reconnected it to the malware that relies on it, updating 28 existing Mobile Software entries, including S0422: Anubis, S0480: Cerberus, S0440: Agent Smith, and S0318: XLoader for Android, along with the Groups that distribute them, such as G0070: Dark Caracal and G0112: Windshift.We also added S9040: NGate, which relays victims’ payment card data through the phone’s tap-to-pay (NFC) chip so an adversary can withdraw cash at an ATM, and a newer variant also captures card PINs. S0491: StrongPity now spans Enterprise and Mobile.Up Next | ATT&CKcon 7.0 & v21Join us for ATT&CKcon 7.0, October 27–28, in McLean, VA, or online. We still have in-person seats, so register here, and virtual registration is open. If your organization wants to sponsor, email us at attack@mitre.org. You’ll find hotel and venue details in the FAQ.We’ve already started on the v21 release, planned for April. Tell us what you’d like to see and if you see something, contribute something.Thank YouMany of the objects, Campaigns, Techniques, and DETs, in this release started with someone’s report, feedback, or question. Thank you to the researchers, defenders, and vendors who published what they found and or shared observations with us. You’ll find every v20 contributor in the release notes.Connect with us via email, LinkedIn, Slack, Bluesky, or XATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.MITRE ATT&CK® – MediumRead More