What happened
MITRE published version 20 of its ATT&CK framework last week. The organisation describes the biggest change as "expanded coverage of recent adversary activity and tradecraft," and the additions show where the tradecraft has moved.
The Enterprise domain gains nine additions across techniques and sub-techniques. Prompt injection is now tracked as two separate techniques, one for malicious instructions typed directly into a model's interface and one for instructions hidden in material the model ingests. A further technique describes attackers using an organisation's own AI agents to steal data, with sub-techniques for poisoning web content to steer AI search and assistant recommendations and for disrupting LLM-assisted malware analysis. Separately there is a new technique for the theft of application-specific passwords, which attackers can use to sign in without triggering an MFA prompt, and another for bypassing CAPTCHA checks, with sub-techniques for solving them automatically and for avoiding them. The existing sub-technique on compromised software dependencies and development tools now also covers IDE and coding agent configuration files.
The ICS domain gets its own campaign entries. One tracks attacks on internet-exposed programmable logic controllers at more than 30 water and wastewater utilities in Minnesota, which left operators locked out. MITRE notes attribution remains unconfirmed. A second documents an AI-assisted breach of Mexican government institutions that spanned IT and OT and reached a municipal water utility. ICS also gains a Command and Scripting Interpreter technique with sub-techniques for six interpreters, replacing the deprecated Command-Line Interface and Scripting techniques.
On the actor side, MITRE added Nimbus Manticore, an IRGC-associated espionage group targeting aerospace, defence and telecoms. Salt Typhoon's entry now covers exploitation of network edge devices, and APT38's entry reflects a shift from financial theft toward software supply chain attacks. The Gentlemen ransomware-as-a-service operation is new. Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics, with the ICS analytics built to ignore routine engineering and maintenance work.
Why this is a GRC story
A technique ID is what makes an AI risk statement testable. For two years, governance documents have said the organisation is exposed to prompt injection without any shared way to describe the exposure, the control or the evidence. Two techniques and a sub-technique now exist to point at. That is the difference between a risk register entry and something an assessor can score.
MFA is the uncomfortable one. Most control frameworks treat multi-factor authentication as a settled answer. A catalogued technique for stealing application-specific passwords and signing in without an MFA prompt asks whether the standard relies on the prompt itself or on the conditions around it. Reviews that stop at "MFA enforced" will pass while the technique works.
What to watch
Watch how quickly vendor detection libraries claim coverage of the new Enterprise techniques, and whether those claims are tested against the analytics MITRE published or merely name-checked. Watch whether the ICS additions move regulators to ask water utilities harder questions about internet-exposed controllers, especially with attribution still open in Minnesota.
The usable next step is small. Take the new techniques, ask your team which ones you could detect today, and write the answer down with a date. A framework update is only useful if it changes something in a document you own.
Attribution: Analysis based on SecurityWeek and related public reporting. This article is original commentary, not a repost of the source material.