ATT&CK v20 adds Direct and Indirect Prompt Injection, AI-Enabled Exfiltration, CAPTCHA evasion and app-password theft, plus The Gentlemen RaaS and US water-utility attacks
MITRE released ATT&CK v20 on Oct 13. It has 227 Enterprise techniques and 479 sub-techniques. New Enterprise entries useful for detection mapping:
- T1699 Direct Prompt Injection and T1698 Indirect Prompt Injection, for instructions hidden in content a model ingests.
- T1700 AI-Enabled Exfiltration, for abusing an organization's own AI agents to pull data out.
- T1608.007 AI Result Poisoning, for seeding web content to sway AI search and assistant answers.
- T1685.007 Impair Autonomous Defenses.
- T1697 Steal Application Specific Passwords, which sign in without an MFA prompt.
- T1696 Anti-Automation Evasion, with .001 Automate CAPTCHA Completion and .002 Avoid CAPTCHA.
New groups are G1059 Nimbus Manticore and G1058 The Gentlemen (with The Gentlemen Ransomware as software). Campaigns include C0064 AI-Assisted Breach of Mexico's Government Infrastructure and, in ICS, C0066 2026 U.S. Water Utilities Attacks. ICS also gets T1701 Command and Scripting Interpreter, with six interpreter sub-techniques, and C2 over DNS and publish/subscribe protocols. Mobile adds NGate, the NFC card-relay malware. If you tag detections or hunts to ATT&CK, pull the v20 changelog and map your prompt-injection and agent-abuse detections to the new IDs.
Sources: MITRE ATT&CK updates (v20) · ATT&CK v19.2 to v20.0 detailed changelog · mitre/cti release ATT&CK-v20.0 (Oct 13) · SecurityWeek