MITRE ATT&CK v20 adds AI abuse, MFA bypass, and water utility attack techniques

1. Executive summary

MITRE released ATT&CK v20, adding nine Enterprise techniques and sub-techniques (prompt injection, theft of application-specific passwords used to sign in without an MFA prompt, CAPTCHA bypass, AI-agent data theft, poisoning of web content that feeds AI assistants) and new ICS campaigns, including attacks on internet-exposed PLCs at more than 30 water and wastewater utilities in Minnesota that locked operators out of their systems. No CVE, CVSS score, EPSS value or CISA KEV entry is associated with this item; it is a framework release, not a vulnerability disclosure. The direct risk to EMEA financial services is not a new exploit but a detection gap: the techniques MITRE has now named describe MFA bypass through stolen application passwords and abuse of AI agents and coding-assistant configuration, both of which map onto identity and software-supply-chain controls banks already run. Attribution for the Minnesota intrusions is unconfirmed in MITRE's own entry, and the Iranian-affiliated link reported elsewhere is single-sourced and should not be treated as established.

2. Regulatory framing

No DORA incident-reporting article is engaged: this item reports a framework release and third-party intrusions, not an incident at the client.

3. Technical analysis & attack chain

ATT&CK v20 is a taxonomy update. There is no exploit chain to reproduce, so the numbered steps below describe what the new entries document about adversary behaviour, not a sequence observed in a single intrusion.

1. An adversary obtains application-specific passwords (app passwords) that authenticate without an MFA prompt, and uses them to sign in to the victim account.
2. Separately, an adversary bypasses CAPTCHA checks, either by solving them automatically or by avoiding them, to reach bot-protected services at scale.
3. Prompt injection is used against an LLM, either by typing malicious instructions into the model's interface or by hiding instructions in material the model ingests.
4. An adversary turns an organisation's own AI agents to data theft, and poisons web content to sway what AI search and assistant tools recommend.
5. In ICS, internet-exposed PLCs at more than 30 water and wastewater utilities in Minnesota were attacked, leaving operators locked out of their systems.

The Enterprise additions that matter most to a bank are the identity and AI ones. Theft of application-specific passwords is the mechanism behind MFA bypass that does not require defeating the second factor: the credential itself is exempt from the prompt. Any estate where app passwords, legacy authentication or token-based access can be minted by users needs an inventory of those paths, because the technique MITRE has now catalogued is exactly the abuse of that exemption. The prompt-injection pair (direct input, and instructions hidden in ingested content) plus the AI-agent data-theft and web-content-poisoning sub-techniques describe attacks on LLM-backed assistants and search. The practical exposure is any internal assistant or copilot that can read mail, documents or tickets and act on them. The extension of the compromised-dependencies sub-technique to IDE and coding agent configuration files means a poisoned .cursorrules-style config, agent instruction file or IDE plugin setting is now treated as a supply-chain vector; the source does not name specific file paths, so treat the class of file as the target rather than a fixed list.

MITRE also restructured ICS: a new Command and Scripting Interpreter technique with sub-techniques for six interpreters replaces the deprecated Command-Line Interface and Scripting techniques, and two new sub-techniques cover command and control hidden in DNS and in publish/subscribe protocols. Detection content was expanded with 15 new detection strategies (six Enterprise, nine ICS) backed by 38 analytics; the ICS analytics are tuned to ignore routine engineering and maintenance work. Mobile gains a restored technique for delivering apps outside official stores (last in v11) and a new entry for NGate, malware that relays payment card data through a phone's NFC to enable ATM cash withdrawal. NGate is the one Mobile addition with direct relevance to retail banking and ATM fleets.

On actors: MITRE added Nimbus Manticore, described as an IRGC-associated espionage group targeting aerospace, defense and telecoms, with its tools. Salt Typhoon's entry now covers exploitation of network edge devices. APT38's entry now reflects a shift from financial theft to software supply chain attacks. The Gentlemen is added as a ransomware-as-a-service operator.

Attribution caveats. Nimbus Manticore and The Gentlemen have no MITRE ATT&CK profile in the reference data supplied to this advisory, so any attribution to either group should be treated as unconfirmed until the ATT&CK entry itself is checked. The claim that the wider water-utility wave resembles Iranian-affiliated activity is single-sourced reporting; MITRE states that attribution for the Minnesota intrusions remains unconfirmed, and that is the position to carry. The APT38 shift to supply chain attacks is a change in MITRE's entry, not an observation of a specific campaign.

4. Mitigation & containment

P1 (within 24h)

• Inventory and, where not operationally required, disable application-specific passwords and legacy authentication paths across Microsoft 365, Google Workspace and any IdP that issues app passwords. The new ATT&CK technique is the abuse of credentials that skip the MFA prompt; removing the exemption closes it.
• Pull authentication logs for sign-ins that used app passwords or token-based access in the last 30 days and review for anomalous source geography or user-agent. This is the detection the technique implies.
• For any internal LLM assistant or copilot with read access to mail, documents or tickets, confirm what actions it can take and restrict write or send capability until prompt-injection exposure is assessed.

P2 (within 72h)

• Add IDE and coding-agent configuration files (agent instruction files, plugin settings, .cursorrules-class files) to source-control review and to the dependency-integrity checks that already cover package manifests. The ATT&CK change puts these in the supply-chain sub-technique.
• Review CAPTCHA and bot-protection coverage on customer-facing login, registration and payment endpoints, and confirm the provider detects automated solving rather than only volumetric abuse.
• For firms running ATM fleets or mobile banking, brief fraud teams on NGate's NFC card-relay pattern so that ATM withdrawal anomalies tied to mobile NFC are on the watch list.

P3 (within 7 days)

• Map current detection coverage against the 15 new detection strategies and 38 analytics in v20, prioritising the six Enterprise strategies, and close gaps in identity and AI-assistant monitoring first.
• For any OT or utility-adjacent exposure (facilities, building management, subsidiary infrastructure), review whether internet-exposed PLCs exist and whether they are reachable from untrusted networks. The Minnesota campaign is the reference case for why that exposure matters.

5. Indicators of compromise

No indicators of compromise available in the source material. The item is a framework release and names no hashes, domains, IP addresses or file paths.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source names techniques and malware families but provides no strings, command lines, file names, registry keys or other artefacts of the threats themselves. A rule built on technique names or the string "NGate" would detect reporting about the threat, not the threat.

Threat actor context

Salt Typhoon · G1045

Salt Typhoon is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).

APT38 · G0082 · aka NICKEL GLADSTONE, BeagleBoyz, Bluenoroff, Stardust Chollima, Sapphire Sleet

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau. Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. …

No MITRE ATT&CK profile for: Nimbus Manticore, The Gentlemen.

7. Sources

• SecurityWeek, "MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks", https://www.securityweek.com/mitre-attck-v20-catalogs-ai-abuse-mfa-bypass-water-utility-attacks/, 2026-10-19. Single source for all technical detail in this advisory; the underlying ATT&CK v20 entries were not independently retrieved.

8. Adverse Trace position

This is a framework release with no CVE, no CVSS score, no EPSS value and no CISA KEV entry, so we do not assign it a vulnerability severity; its value is as a detection and control checklist. The client impact we assess as material is concentrated in two places: identity estates that still permit application-specific passwords to skip MFA, and AI assistants or coding agents with broad read or act permissions and no review of their configuration files. The water-utility and NGate items are relevant to clients with OT exposure or ATM and mobile banking operations respectively. We treat the Iranian-affiliated attribution for the Minnesota intrusions as unconfirmed, consistent with MITRE's own statement, and the Nimbus Manticore and The Gentlemen attributions as unconfirmed pending verification against the ATT&CK entries. Next, we will retrieve the v20 Enterprise and Mobile entries directly to extract technique IDs and any atomic artefacts, and reissue this advisory with detection content if usable indicators are published. Clients should action the P1 identity steps today rather than wait for that revision.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.