MITRE Releases ATT&CK Version 20 Addressing AI Abuse and Infrastructure Attacks

The MITRE Corporation released version 20 of its ATT&CK framework last week to address recent attacker behavior and tradecraft, SecurityWeek reported. The update provides cybersecurity defenders with 15 new detection strategies and 38 analytics across enterprise and industrial control systems environments. [1]

According to SecurityWeek, the Enterprise domain received nine new techniques and sub-techniques. These updates include specific classifications for artificial intelligence prompt injection, tracking both direct malicious instructions entered into a large language model interface and indirect instructions embedded within ingested material. [1]

The new release also catalogs multi-factor authentication bypass techniques and operational technology threats, SecurityWeek reported. These additions reflect recent adversary activity targeting public infrastructure, including municipal water utilities. [1]

The Adversarial Tactics, Techniques, and Common Knowledge framework was created by the MITRE Corporation and released in 2013 to classify and describe cyberattacks and intrusions. Between July 26 and July 27, 2026, a coordinated cyberattack targeted more than 30 municipal water systems in Minnesota, where investigators suspect Iranian hackers were responsible. [3][4]