MITRE ATT&CK v20: New ICS Campaigns, PLC Malware and OT Detection
MITRE has released ATT&CK v20 with new ICS campaigns and software, a command interpreter technique, and detection strategies that account for asset and platform context. Here is what changes for those running industrial networks.
MITRE announced version 20 of the ATT&CK framework this week. The news was reported by Industrial Cyber on October 16, 2026, and the release was described by Amy L. Robertson in a post on the ATT&CK team's Medium blog. The update broadens coverage of threats to critical infrastructure, AI-enabled attacks and cyber espionage. This article is based on Industrial Cyber's reporting; we have not directly verified MITRE's own pages.
Two new ICS campaigns
The first is C0066, "2026 U.S. Water Utilities Attacks". The activity has not been formally attributed. It reached internet-exposed PLCs at more than 30 water and wastewater utilities in Minnesota, locking operators out of their own systems. The entry point, therefore, was the direct exposure of the controllers.
The second is C0064, "AI-Assisted Breach of Mexico's Government Infrastructure". The campaign crossed the boundary between IT and OT, moved across several government institutions and reached a municipal water utility.
New software and new techniques
Among the ICS-related additions:
- S9046 IOControl: malware attributed to the CyberAv3ngers group (G1027), targeting Linux-based IoT and OT devices, including PLCs, HMIs and fuel management systems.
- S9045 BACKUPOSINT v9.0 APEX PREDATOR: a 49-module Python toolkit generated with AI, used in the Mexico breach.
- T1701 Command and Scripting Interpreter, with six sub-techniques (PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python, JavaScript). It replaces T0807 and T0853, which are now deprecated.
- T0869.001 (DNS) and T0869.002 (publish/subscribe protocols): command and control hidden in protocols already present on industrial networks.
- M1061 Limit Software/Package Installation: a mitigation to prevent unauthorized software from being installed on ICS assets.
The enterprise side and AI
On the enterprise side, there are new techniques covering prompt injection, AI-assisted data exfiltration, AI output poisoning and attacks against AI-based defenses. It is a sign that AI systems are now regarded as both a tool and a target.
More context-aware detection
For defenders, the most interesting change is in detection. ICS detection strategies now include platform and asset context, such as engineering workstations and PLCs. The release contains 15 new detection strategies and 38 analytics across enterprise and ICS environments. The industrial ones are designed to filter out normal engineering and maintenance activity, reducing false positives.
The release also introduces NIMBUS MANTICORE (G1059), an Iran-linked espionage group associated with the IRGC, which targets aerospace, defense and telecommunications, with 13 related software entries. We have no further information on the details of this part.
Why it matters for OT teams
The new sub-techniques for scripting, DNS and pub/sub mirror what is common on industrial networks, such as MQTT-style messaging. This traffic is legitimate and therefore easy to blend into: a threat model that ignores it leaves a blind spot.
In the Minnesota case, the entry point was PLCs reachable from the internet.
What to do in practice
Some concrete steps:
- Check whether any PLCs or HMIs are reachable from the internet and, where possible, remove the exposure or protect it with controlled remote access.
- Update your threat model mapping and detection rules, accounting for the deprecation of T0807 and T0853 in favor of T1701.
- Assess whether your DNS monitoring and publish/subscribe traffic inspection cover the new command-and-control scenarios.
- Review who can install software on ICS assets, in line with M1061.
- Test the new analytics on engineering workstations to measure how much they reduce false positives in your own environment.
ATT&CK v20 does not replace baseline security measures, but it offers a common language for linking real incidents, detection and mitigation priorities. Note that the Minnesota campaign remains unattributed, and the details should be checked against MITRE's official documentation.