MITRE ATT&CK v20 adds AI abuse, MFA bypass, and utility attacks
Original title: MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks
Enterprise gains nine entries, ICS adds two campaigns plus analytics, and Mobile restores sideloading and NGate.
MITRE released ATT&CK version 20 with expanded coverage of recent adversary activity. Enterprise additions include prompt injection, abuse of an organization’s AI agents, poisoned web content, disruption of LLM-assisted malware analysis, theft of application-specific passwords, and CAPTCHA bypass. ICS coverage includes attacks on internet-exposed PLCs at more than 30 Minnesota water and wastewater utilities and an AI-assisted breach of Mexican government institutions that reached a municipal water utility. New or updated actor entries cover Nimbus Manticore, Salt Typhoon, APT38, and The Gentlemen.
Unconfirmed: MITRE says attribution for the Minnesota water-utility intrusions remains unconfirmed.
- Prompt injection is split into direct interface input and hidden ingested instructions.
- A technique tracks application-specific passwords that skip an MFA prompt.
- Minnesota operators were locked out of systems; attribution remains unconfirmed.
- Defenders get 15 detection strategies and 38 analytics, including nine ICS strategies.
- Mobile again covers apps delivered outside official stores and adds NGate NFC malware.
- Vendors
- MITRE
- Products
- ATT&CK
- Threat actors
- Nimbus ManticoreSalt TyphoonAPT38The Gentlemen
- Malware
- NGate
From the original article
2 min read at securityweek.com
Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics. The post MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.