MITRE has unveiled version 20 of its ATT&CK framework, incorporating new entries that address the misuse of artificial intelligence, multi-factor authentication (MFA) circumventions, and recent breaches impacting water utilities. This expansive update aims to enhance the understanding of modern adversary tactics and techniques.
Key Enhancements in ATT&CK v20
The latest iteration of the ATT&CK framework significantly expands its scope by incorporating new techniques targeting enterprise domains. Noteworthy among these are two new methods of prompt injection. One method involves entering harmful instructions directly into a large language model’s (LLM) interface, while another focuses on embedding instructions within content that the model processes.
Furthermore, attackers are increasingly leveraging AI agents within organizations to exfiltrate data. Additional sub-techniques cover the manipulation of web content to modify AI search outcomes and the disruption of LLM-enhanced malware analyses. These updates provide a more nuanced view of how adversaries exploit AI systems.
Exploiting Security Measures
MITRE’s latest framework also delves into techniques employed to bypass security protocols. This includes a novel method to steal application-specific passwords, enabling attackers to access systems without triggering an MFA request. There are also techniques aimed at overcoming CAPTCHA challenges, involving both automated solutions and avoidance strategies.
Efforts to circumvent software dependencies and development tools now account for compromised configuration files in integrated development environments (IDEs) and coding agents. These insights are crucial for understanding the ways attackers bypass security measures like MFA and bot checks.
Threats to Industrial Control Systems
The updated ATT&CK framework highlights a series of attacks on internet-exposed programmable logic controllers (PLCs) across over 30 water and wastewater facilities in Minnesota. These incidents resulted in operators losing access to their systems. Although some speculate Iranian involvement, MITRE notes that the attribution remains unconfirmed.
Another campaign details an AI-enabled breach of Mexican governmental bodies, impacting both IT and operational technology (OT) systems, including a municipal water utility. The framework now also includes the Command and Scripting Interpreter Technique, which replaces the outdated Command-Line Interface and Scripting techniques.
Emerging Threat Actors and Detection Strategies
MITRE’s update introduces new threat actors, including Nimbus Manticore, linked to IRGC espionage targeting aerospace, defense, and telecommunication sectors. The framework also updates entries for China-backed Salt Typhoon and North Korea’s APT38, outlining their evolving methods.
Additional detection strategies have been introduced, with 15 new methodologies, including six for enterprise settings and nine for industrial control systems (ICS). These are supported by 38 analytics, specifically designed to distinguish routine maintenance from potential threats.
As cyber threats evolve, MITRE’s ATT&CK v20 provides a comprehensive view of the latest adversary tactics, offering valuable insights for security professionals to safeguard against these emerging threats.
