MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT attack techniques

As cited

Copy frozen at 2026-10-16 11:45 UTC (site build).

ot ics

MITRE ATT&CK v20 expands critical infrastructure threat coverage with new IT and OT attack techniques

MITRE released ATT&CK v20, expanding coverage of critical infrastructure threats with new campaigns documenting attacks on over 30 Minnesota water utilities and an artificial intelligence (AI)-assisted breach of Mexican government infrastructure spanning information technology (IT) and operational technology (OT) environments. The update adds techniques for tracking command execution and command-and-control activity across industrial networks, including abuse of DNS and publish/subscribe protocols, plus nine new enterprise techniques addressing prompt injection, AI-enabled data exfiltration, and AI result poisoning. The release includes 15 new detection strategies and 38 analytics designed to help security teams align defenses with specific assets while filtering routine engineering and maintenance activity.

Why it matters: Water utility operators and critical infrastructure defenders need to understand the new attack techniques and campaigns documented in v20, particularly the 2026 U.S. water utility attacks and cross-domain Mexico breach, to update their detection and response playbooks. Enterprise defenders must prepare for AI-focused attack techniques including prompt injection and attacks on AI-assisted defenses. Organizations running industrial control system (ICS) environments benefit from improved detection strategies that account for platform-specific assets like programmable logic controllers and engineering workstations.

Source published

2026-10-16 10:21 UTC

First seen by Cybersecurity Tracker

2026-10-16 10:24 UTC