MITRE ATT&CK v20 adds AI abuse, MFA bypass and water utility attack techniques

MITRE released version 20 of its ATT&CK framework, adding nine techniques and sub-techniques to the Enterprise domain, including prompt injection, theft of application-specific passwords to bypass MFA, and CAPTCHA evasion. The ICS domain now tracks attacks on internet-exposed PLCs at over 30 Minnesota water utilities and an AI-assisted breach of Mexican government institutions.

• Prompt injection split into two techniques: direct LLM input and hidden instructions in ingested data
• New technique covers theft of application-specific passwords to sign in without MFA
• ICS campaign tracks attacks on PLCs at 30+ Minnesota water utilities, operators locked out
• 15 new detection strategies and 38 analytics added, plus NGate NFC card-relay malware