MITRE ATT&CK v20 updates Enterprise and ICS matrices across AI agents and water utilities

01. What changes with the October 2026 release

On October 13, 2026, MITRE released version 20 of the ATT&CK knowledge base, updating the three distinct matrices for the Enterprise, Mobile, and Industrial Control Systems (ICS) domains. The release brings the overall catalog to 971 pieces of software, 182 groups, and 61 documented campaigns, broken down across each domain according to the official release notes.

The defining trait of this release lies in the convergence, within the same update cycle, of offensive use of artificial intelligence models and agents, intrusion automation, and direct attacks against physical industrial processes. Nine new techniques and sub-techniques enter the Enterprise domain, five of which focus specifically on AI security. Nine new entries debut in the ICS domain covering command and scripting interpreters, DNS, and publish/subscribe protocols.

On the defensive side, the release introduces 15 new Detection Strategies overall (6 for Enterprise, DET0922, DET0926, DET0927, DET0937, DET0938, and DET0939, and 9 for ICS, DET0928-DET0936) supported by 217 new version 1.0 analytics in total, split into 12 Enterprise analytics (10 tied to the 6 new Enterprise strategies, AN2068, AN2075-AN2080, and AN2104-AN2106, plus 2 analytics, AN2070 and AN2074, added to pre-existing strategies DET0923 and DET0925) and 205 ICS analytics (comprising 22 analytics, AN2082-AN2103, tied to the 9 new ICS Detection Strategies and 183 analytics, AN2107-AN2289, added across 69 pre-existing ICS Detection Strategies from DET0722 to DET0912 updated with platform and asset context).

02. The five new AI Security entries in the Enterprise domain

For teams designing, integrating, or defending applications built on large language models and autonomous agents, ATT&CK v20 formalizes five distinct adversary behaviors in the Enterprise matrix, all introduced at version 1.0. Three are top-level techniques and two are sub-techniques placed under existing parent techniques.

Alongside these five entries, the Enterprise matrix introduces Anti-Automation Evasion (T1696) with two sub-techniques covering automated completion (Automate CAPTCHA Completion, T1696.001) and control bypass (Avoid CAPTCHA, T1696.002), the technique Steal Application Specific Passwords (T1697) targeting application credentials that bypass standard MFA workflows, the major revision (v2.0) of Supply Chain Compromise · Compromise Software Dependencies and Development Tools (T1195.001), and the minor update (v1.2) of Obtain Capabilities · Artificial Intelligence (T1588.007). The catalog also adds the groups NIMBUS MANTICORE (G1059) and The Gentlemen (G1058), updates APT38 (G0082, v4.0) and Salt Typhoon (G1045, v2.0), and in the Mobile domain restores Deliver Malicious Application via Other Means (T1476, v2.0) while adding NGate (S9040, v1.0) and updating StrongPity (S0491, v2.0).

03. Campaign C0064 in Mexico, when the AI agent becomes part of the intrusion chain

The campaign cataloged as C0064 (AI-Assisted Breach of Mexico's Government Infrastructure), listed in v20 under both Enterprise and ICS campaign additions, documents operations conducted between December 2025 and February 2026 against multiple Mexican public institutions, including the Federal Tax Authority, the State Government of Mexico, the Mexico City Civil Registry and Health Department, the state governments of Jalisco, Michoacán, and Tamaulipas, the National Electoral Institute, and the Monterrey municipal water utility SADM.

According to the MITRE campaign record, human operators used Claude Code and OpenAI GPT-4.1 (T1588.007, T1682, T1059.009) to assist with reconnaissance, vulnerability scanning (T1595.002), privilege escalation, credential harvesting, and automated exfiltration of government records (T1020). Two separate technique mappings in C0064 document the mechanism involving the file claude.md. Under T1699 (Direct Prompt Injection), MITRE records that the adversary abused Claude Code through a file write operation in the prompt to create a claude.md file containing a pre-compiled 1,084-line document with penetration testing scripts used in the campaign. Under T1554 (Compromise Host Software Binary), MITRE records that the adversary instructed Claude Code to add a skills file named claude.md in the project root directory, which was automatically loaded at the start of every Claude Code session and regularly updated with modifications and findings.

During the same campaign, MITRE documents the generation and execution of Python scripts including BACKUPOSINT v9.0 APEX PREDATOR (S9045), the use of SSH tunnels and proxies across VPS infrastructure, the upload of a web shell to the public SADM portal (T1505.003), enumeration of an industrial vNode gateway and SCADA/IIoT management platform (T1018), and password spraying attempts against a SCADA web interface (T1110.003). A strict analytical distinction applies here. The presence of a municipal water utility among the victims and login attempts against a SCADA web interface do not, by themselves, prove a successful compromise of physical OT process control. MITRE explicitly notes that public reporting provides only selected details and should not be considered exhaustive.

04. Campaign C0066 in Minnesota, physical impact on water utilities

A contrasting operational profile emerges from campaign C0066 (2026 U.S. Water Utilities Attacks), recorded in the ICS domain starting July 27, 2026. More than thirty municipal drinking water and wastewater utilities in Minnesota were impacted as part of a broader wave reported by the FBI and EPA across at least seven U.S. states.

Attackers targeted internet-facing Rockwell Automation / Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLC) reachable through cellular gateways installed at water towers and sewage lift stations (T0883). After gaining access using default credentials (T1694.001), the operators modified device IP addresses (T0836) and passwords (T0892), cutting local technicians off from monitoring (Loss of View, T0829) and control functions (Loss of Control, T0827 and Denial of Control, T0813). At least one facility experienced altered PLC control logic resulting in ladder logic discrepancies (Modify Program, T0889). Reported operational consequences included water pressure drops, localized flooding, and a well and treatment plant temporarily taken offline, alongside cellular connectivity loss across multiple sites that forced operators to switch to manual control (Loss of Availability, T0826). MITRE notes that the campaign remains formally unattributed and that while broader activity aligns with patterns linked to Iran-affiliated actors, specific attribution for the Minnesota intrusions remains unconfirmed.

In the ICS domain, version 20 accompanies this campaign with the introduction of Command and Scripting Interpreter (T1701) and six sub-techniques (PowerShell T1701.001, Windows Command Shell T1701.002, Unix Shell T1701.003, Visual Basic T1701.004, Python T1701.005, and JavaScript T1701.006, deprecating the legacy Command-Line Interface T0807 and Scripting T0853 techniques), two new sub-techniques for DNS (T0869.001) and Publish/Subscribe Protocols (T0869.002) under Standard Application Layer Protocol, the major update to Spoof Reporting Message · Command Message (T1692.001, v2.0), and the new mitigation Limit Software/Package Installation (M1061, v1.0), alongside nine new ICS Detection Strategies (DET0928-DET0936).

05. Evidence verification matrix and analytics reconciliation

06. What this means for organizations adopting AI agents in enterprise and government

Reading the five new Enterprise AI techniques alongside campaign C0064 clarifies why evaluating the risk of an autonomous agent cannot stop at filtering user text in a chat window. When an assistant or agent has permissions to read files in a workspace, process content retrieved from external sources through web search or retrieval-augmented generation (T1698, T1608.007), and invoke enterprise tools or APIs (T1700), the exposure surface spans the entire execution chain.

The mitigations documented under T1699, T1698, and T1700 explicitly highlight Execution Prevention (M1038) and Application Isolation and Sandboxing (M1048). Specifically, the technical guidance emphasizes preventing instructions inside user prompts or external content from directly authorizing consequential actions, requiring that tool invocations, API calls, commands, and resource access be validated outside the model prior to execution. In the Mexican campaign C0064, the combined use of writing claude.md via prompt (T1699) and loading that file automatically at the start of every session (T1554) underscores the importance of integrity controls over local configuration and instruction files.

For teams governing LLM-based architectures in enterprise or public sector environments, the taxonomy introduced in ATT&CK v20 outlines four architectural verification areas for threat modeling.

1. Separation between system instructions and untrusted data originating from external sources or search results (T1698, T1608.007).
2. Integrity and provenance verification for instruction files, scripts, and dependencies automatically loaded into agent workspaces (T1554, T1195.001).
3. Authorization checks enforced outside the model prior to executing calls to tools, databases, or outbound communication channels (T1699, T1700, M1038).
4. Monitoring the integrity of analysis pipelines whenever language models support defensive or triage workflows (T1685.007).

Within MC Project Lab's research roadmap, these four areas provide the methodological reference for future evaluation activities concerning laboratory projects including Vigil, AI Prompt Firewall (AIPF), and Therminal CT (TCT).

Primary sources consulted

• [S1] MITRE ATT&CK · Updates October 2026 (13 October 2026)
• [S2] MITRE ATT&CK · Campaign C0064, AI-Assisted Breach of Mexico's Government Infrastructure
• [S3] MITRE ATT&CK · Campaign C0066, 2026 U.S. Water Utilities Attacks
• [S4] MITRE ATT&CK · Detailed Changelog v19.2 - v20.0
• [S5] MITRE ATT&CK · Machine-Readable Changelog v19.2 - v20.0 (JSON)