MITRE ATT&CK v20 Examines AI Abuse, MFA Bypass, and Water Utility Threats

Post Views: 15

MITRE ATT&CK v20 introduces updated entries addressing AI misuse, multi-factor authentication (MFA) circumvention, and recent cyberattacks targeting water infrastructure.

MITRE ATT&CK v20 Updates

The framework’s latest iteration emphasizes expanded coverage of adversary tactics and operational methods. The Enterprise domain now includes nine new techniques and sub-techniques, with prompt injection categorized into two distinct methods. One involves direct malicious input to large language models (LLMs), while the other focuses on embedding deceptive instructions within data ingested by AI systems.

Enterprise Domain Enhancements

Additional techniques detail the exploitation of organizational AI agents to exfiltrate data, as well as methods to manipulate AI search results and disrupt malware analysis workflows. A separate entry addresses the theft of application-specific passwords, enabling unauthorized access without MFA prompts. Sub-techniques include automated CAPTCHA solving and evasion tactics.

MITRE highlights these updates as critical for understanding how adversaries bypass MFA, bot detection mechanisms, and AI defenses.

Industrial Control Systems (ICS) Domain

In the Industrial Control Systems (ICS) domain, a campaign targeting over 30 water and wastewater utilities in Minnesota involved attacks on internet-facing programmable logic controllers (PLCs), resulting in system access restrictions. While some reports link the activity to Iranian-affiliated actors, MITRE notes that attribution remains unverified.

Threat Actor Updates

A separate incident involved an AI-assisted breach of Mexican government agencies, affecting both IT and operational technology (OT) systems, including a municipal water utility. The ICS framework now includes the Command and Scripting Interpreter Technique, with sub-techniques for six interpreters, replacing older entries. Additional sub-techniques cover covert command and control traffic within DNS protocols and publish/subscribe messaging.

Defensive Measures

Threat actor updates include the addition of Nimbus Manticore, an Iran Revolutionary Guard Corps (IRGC)-affiliated group targeting aerospace, defense, and telecommunications sectors. China-linked Salt Typhoon now includes exploitation of network edge devices, while North Korea’s APT38 is revised to reflect a shift from financial theft to software supply chain attacks. A new entry for The Gentlemen, a ransomware-as-a-service operation, is also included.

ICS Analytics and Mobile Domain

Defensive measures gain 15 new detection strategies, with six for Enterprise and nine for ICS, supported by 38 analytics. ICS analytics are designed to filter out routine maintenance activities. The Mobile domain reintroduces a technique for distributing malicious applications outside official app stores, last documented in version 11. A new entry details NGate malware, which intercepts payment card data via a device’s near-field communication (NFC) module to facilitate ATM cash withdrawals.

Notable Updates and Cybersecurity Developments

Other notable updates include MITRE’s focus on AI abuse, MFA bypass methods, and ICS vulnerabilities, alongside broader cybersecurity developments such as zero-day patches, ransomware campaigns, and threat actor activities across multiple sectors.