ATT&CK v20 brings more critical infrastructure and cross-domain activity into the framework, with Campaigns for attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure that reached both IT and OT, along with new and updated Groups and Software tied to Iranian cyber espionage, Chinese and North Korean operations, and ransomware. Enterprise gains AI-focused and AI-enabled Techniques, ICS added Techniques for command and script execution and command and control over protocols industrial networks already use, and Mobile un-deprecated a Technique for delivering malicious apps outside official stores. On the defensive side, ICS Detection Strategies (DETs) now carry platform and Asset context, tying behaviors to the operational role of each system, and Mobile DETs reflect the visibility limits of Android and iOS.

Here’s what’s in v20:

• ICS: Two Campaigns, the 2026 U.S. water utility attacks and the IT/OT breach of Mexican government infrastructure; two new pieces of Software, CyberAv3ngers’ IOControl and the AI-generated toolkit from the Mexico breach; and Command and Scripting Interpreter with six Sub-Techniques plus two new command and control Sub-Techniques, so ICS mappings can align to the specific interpreter or protocol an adversary used.
• Cyber Threat Intelligence (CTI): Iran-linked NIMBUS MANTICORE and 13 pieces of its espionage toolkit; updates to People’s Republic of China (PRC)-backed Salt Typhoon on its exploitation of edge devices at telecom providers and to North Korea’s APT38 on its software supply chain compromises; and The Gentlemen’s ransomware, locks ESXi hosts and network-attached storage (NAS) as well as endpoints., plus the Vidar infostealer.
• Enterprise: Nine new Techniques and Sub-Techniques for prompt injection, AI-enabled exfiltration, AI result poisoning, attacks on AI-assisted defenses, CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) evasion, and application-specific password theft, plus a supply chain update that reaches into developer tooling, so mappings can capture how adversaries get around Multi-Factor Authentication, bot checks, and AI systems.
• Defense: Platform and Asset context for ICS DETs, Mobile DETs that reflect what Android and iOS let defenders see, and 15 new DETs and 38 Analytics for this release’s behaviors, with ICS Analytics tuned to filter out routine engineering and maintenance activity.
• Mobile: An un-deprecated Technique for delivering malicious apps outside official stores, malware that relays tap-to-pay card data to an adversary for ATM cash-outs, and 28 revised Software entries.

You’ll find the full details in the release notes, detailed changelog, and changelog.json.

ICS | Water Utility and Government Breaches, New OT Malware, and Execution and Command & Control Techniques

The new Campaign, C0066: 2026 U.S. Water Utilities Attacks tracks adversarial activity, that hasn’t been formally attributed, reaching internet-facing Programmable Logic Controller (PLCs) across more than 30 Minnesota water and wastewater utilities and locking operators out of their own systems. C0064: AI-Assisted Breach of Mexico’s Government Infrastructure is a cross-domain Campaign, spanning IT and OT, with intruders moving across Mexican government institutions and reaching a municipal water utility.

We also added two pieces of Software, S9046: IOControl a G1027: CyberAv3ngers’ malware for Linux-based IoT and OT devices, including PLCs, Human-Machine Interface (HMIs), and fuel management systems, and S9045: BACKUPOSINT v9.0 APEX PREDATOR, the AI-generated, 49-module Python toolkit used in the Mexico breach.

Additionally, T1701: Command and Scripting Interpreter was added to ICS, with Sub-Techniques for T1701.001: PowerShell, T1701.002: Windows Command Shell, T1701.003: Unix Shell, T1701.004: Visual Basic, T1701.005: Python, and T1701.006: JavaScript. It replaces T0807: Command-Line Interface and T0853: Scripting, both now deprecated, so ICS mappings can show which interpreter an adversary used.

New T0869.001: DNS and T0869.002: Publish/Subscribe Protocols Sub-Techniques under T0869: Standard Application Layer Protocol capture adversaries hiding command and control in protocols industrial networks already rely on, and M1061: Limit Software/Package Installation addresses keeping unauthorized software off of ICS assets.

Enterprise | MFA Bypass, Developer Tooling, and AI

T1697: Steal Application Specific Passwords tracks adversaries who phish, generate, or harvest application-specific passwords to log in without facing MFA. T1696: Anti-Automation Evasion, with Sub-Techniques T1696.001: Automate CAPTCHA Completion and T1696.002: Avoid CAPTCHA, addresses ways adversaries get past bot checks. We also gave T1195.001: Compromise Software Dependencies and Development Tools a major update to include IDE and coding agent configuration files.

This release also adds AI-focused and AI-enabled Techniques. T1699: Direct Prompt Injection and T1698: Indirect Prompt Injection describe malicious prompts entered into an LLM’s interface or embedded in content it processes. T1700: AI-Enabled Exfiltration captures how adversaries may direct enterprise AI agents to exfil data, and T1608.007: Stage Capabilities: AI Result Poisoning captures the manipulation of web content to influence what AI search and assistants recommend. T1685.007: Disable or Modify Tools: Impair Autonomous Defenses tracks attempts to disrupt LLM-assisted analysis of malware and activity.

Cyber Threat Intelligence | Iranian Espionage, PRC and DPRK Operations, and Ransomware

We added G1059: NIMBUS MANTICORE, an Islamic Revolutionary Guard Corps (IRGC)-associated espionage group that targets aerospace, defense, and telecommunications organizations. We also included 13 pieces of its Software, such as the S9059: MiniBike backdoor and its S9060: MiniBus, S9053: MiniJunk, and S9052: MiniFast successors.

G1045: Salt Typhoon, the PRC-linked group behind compromises of major telecoms providers, received an update covering its exploitation of public-facing network edge devices. The Democratic People’s Republic of North Korea’s (DPRK)-backed G0082: APT38 now reflects its move from financial theft into software supply chain compromises, including poisoned npm packages.

On the criminal side, G1058: The Gentlemen (not really gentlemen) run S9051: The Gentlemen Ransomware, a RaaS with lockers for Windows, Linux, NAS, BSD, and ESXi. We also added S9050: Vidar, a widely used Windows infostealer often deployed alongside ransomware and cryptominers.

Going Agile

In August we released v19.2, our first Agile release for CTI, bringing G1057: ShinyHunters, G1056: TeamPCP, and the S9008: Shai-Hulud family into ATT&CK to ensure defenders could prepare for and respond to them faster. Adversaries don’t wait for our release windows, and Agile releases let us publish Groups, Software, and Campaigns (but not Techniques) when significant activity breaks between biannual versions. We’ll keep doing these agile releases between the cycles, and if you have a rapid release suggestion, let us know.

Defense | ICS Asset Context, Mobile Visibility, and New Detection Strategies

Detection Strategies (DETs) have covered Enterprise, Mobile, and ICS since v18. In v20, we tailored them to what defenders can see in each domain. ICS DETs now name the platforms they apply to (Windows, Linux, Network Devices, and Embedded) and the Assets they target, so you can tell whether a strategy fits an engineering workstation, a PLC, or both. Mobile DETs account for what Android and iOS expose: they separate what you can monitor continuously from what you only see under certain conditions, through device management, or in a forensic review. In all three domains, each DET now links an adversary behavior to the data you can collect for it and the Analytics that use that data.

For this release, we wrote six Detection Strategies for Enterprise and nine for ICS, backed by 38 Analytics. In ICS, each new interpreter has its own strategy, from DET0929: Behavioral Detection of PowerShell Execution in ICS to DET0930: Behavioral Detection of Windows Command Shell Execution in ICS, and the 22 new ICS Analytics are tuned to set aside vendor software, engineering workflows, and approved maintenance, so alerts focus on execution outside the OT baseline. ICS Detection Strategies now list the platforms they apply to, Windows, Linux, Network Devices, and Embedded, so defenders can match each strategy to the assets it covers. In Enterprise, DET0926: Suspicious Acquisition and Use of Application-Specific Passwords pairs with the new MFA bypass Technique. We also updated ten Data Components across all three domains.

Mobile | Deliver Malicious Application via Other Means and Tap-to-Pay Card Fraud

We brought back T1476: Deliver Malicious Application via Other Means, last seen in v11, and rewrote it for how malicious apps reach phones today: direct APK downloads, links sent over SMS, messaging apps, and QR codes, and third-party app stores. With the Technique back, we reconnected it to the malware that relies on it, updating 28 existing Mobile Software entries, including S0422: Anubis, S0480: Cerberus, S0440: Agent Smith, and S0318: XLoader for Android, along with the Groups that distribute them, such as G0070: Dark Caracal and G0112: Windshift.

We also added S9040: NGate, which relays victims’ payment card data through the phone’s tap-to-pay (NFC) chip so an adversary can withdraw cash at an ATM, and a newer variant also captures card PINs. S0491: StrongPity now spans Enterprise and Mobile.

Up Next | ATT&CKcon 7.0 & v21

Join us for ATT&CKcon 7.0, October 27–28, in McLean, VA, or online. We still have in-person seats, so register here, and virtual registration is open. If your organization wants to sponsor, email us at attack@mitre.org. You’ll find hotel and venue details in the FAQ.

We’ve already started on the v21 release, planned for April. Tell us what you’d like to see and if you see something, contribute something.

Thank You

Many of the objects, Campaigns, Techniques, and DETs, in this release started with someone’s report, feedback, or question. Thank you to the researchers, defenders, and vendors who published what they found and or shared observations with us. You’ll find every v20 contributor in the release notes.

Connect with us via email, LinkedIn, Slack, Bluesky, or X

ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

ATT&CK v19 is here, and this release has been a long time coming. The Defense Evasion split is finally in place, detection strategies are expanding into Mobile, the ICS matrix is getting more granular with sub-techniques, and CTI coverage is expanding with AI-orchestrated espionage, Iranian hacktivism, and cross-domain wipers.

This release reflects how we’re continuing to work toward making ATT&CK more actionable at every layer, from clearer tactic boundaries that map to how defenders actually think about adversary intent, new ICS sub-techniques that make broad behaviors more precise and operationally useful, Mobile detection guidance that gives you a traceable path from behavior to telemetry, and threat coverage that reflects where adversaries are operating.

For all the details on our updates/additions across Techniques, Software, Groups and Campaigns take a look at our release notes, our detailed changelog, or our changelog.json.

Enterprise | The Long-Awaited Split and Emerging Technique Coverage

Defense Evasion Split

This release features the long-awaited Defense Evasion split. As we highlighted in the Defense Evasion split blog, Defense Evasion has been covering adversaries blending in and breaking security tools under one tactic, but these are fundamentally different behaviors that need different defensive responses. The split comes down to adversary intent: Stealth covers behavioral camouflage (living-off-the-land binaries, obfuscated payloads, masquerading as legitimate processes), where your defenses are intact and you’re just not seeing the threat. Defense Impairment features the behaviors that are breaking your defenses (killing EDRs, tampering with logging pipelines, subverting trust controls). Some behaviors will be mapped to both Stealth and Defense Impairment, because adversaries don’t always operate cleanly within one intent, and our goal is always to reflect how the adversary is operating.

Here’s the biggest changes you‘ll find from the Defense Evasion split:

• Tactic Changes: Defense Evasion (TA0005) is retired and replaced by two tactics: Stealth, which inherits the tactic ID TA0005, and Defense Impairment, which receives a new tactic ID, TA0112.
• Where Techniques Landed: Most techniques previously in Defense Evasion landed in Stealth or Defense Impairment. A small number of techniques left the former Defense Evasion space entirely, moving to tactics like Lateral Movement, Privilege Escalation, or Execution where they more accurately belong.
• Most Significant Structural Change: T1562: Impair Defenses The parent technique and several sub-techniques have been revoked and restructured. T1562, T1562.001, and T1562.006 are merged into a new parent T1685: Disable or Modify Tools. The remaining sub-techniques have been revoked and reissued under new IDs within Defense Impairment. So, if you’re mapping to any T1562 sub-technique, check the crosswalk, because they have new technique IDs.
• New Techniques: Two new techniques were added: T1687: Exploitation for Defense Impairment and a new sub-technique T1686.003: Disable or Modify System Firewall: Windows Host Firewall.
• Social Engineering Reorganization T1656: Impersonation and T1672: Email Spoofing have been revoked and reissued as sub-techniques under the new technique, T1684: Social Engineering in Stealth (more about this technique below!)

In addition to ATT&CK’s usual changelog, we’re releasing a Defense Evasion split crosswalk in JSON and CSV formats with a detailed breakdown of what happened to every (sub-)technique in Defense Evasion, as well as the handful of new techniques that resulted from this restructuring.

How to Read the Crosswalk

Each entry provides a map for the v18 Defense Evasion techniques or sub-techniques. It shows what the (sub-)technique was called and how it was identified in v18, what it maps to in v19, and whether the change was a relocation or a more significant restructuring.

• The v18 fields (attack-v18-attack-id, attack-v18-stix-id, attack-v18-name, attack-v18-tactics) tell you what you started with.
• The v19 fields (attack-v19-attack-id, attack-v19-stix-id, attack-v19-name, attack-v19-tactics) tell you what to use now. If the item is now a sub-technique, attack-v19-parent-attack-id tells you which parent it belongs under.

Tactic Change Types: Where the Behavior Moved

The tactic-change-type is focused around placement, and tells you where the behavior moved during the split. Tactic change types are:

• Left Defense Evasion
• These techniques now only reside in tactics other than Stealth or Defense Impairment.
• Remains TA0005 -> renamed Stealth (the technique stayed in the TA0005 space, now renamed Stealth)
• These techniques now reside only in Stealth (which retained the tactic ID TA0005).
• Remains TA0005 -> renamed Stealth, and Remains in Additional Tactic(s).
• These techniques are part of the Stealth tactic as well as other tactic(s)
• Moved to new tactic Defense Impairment
• These techniques now reside only in Defense Impairment.
• Moved to new tactic Defense Impairment, and Remains in Additional Tactic(s)
• These techniques are part of the Defense Impairment tactic as well as other tactic(s).

Technique Change Type: How the ATT&CK Object Changed

The technique-change-type outlines if and how the structure of the ATT&CK object has changed. The crosswalk contains a field explaining what change occurred at the technique level. Some are more straightforward:

• Remains a technique
• Remains a sub-technique

Others need more careful review due to more significant structural change:

• Became a new technique
• Became a new sub-technique
• Merged into a new technique
• Revoked [TXXX]

Using the Crosswalk

Step 1: Update Fields

For content mapped to the October 2025/v18 version of ATT&CK, replace the existing technique ID from the value in the attack-v18-attack-id field with the value in the attack-v19-attack-id field. Next, update the technique name to match the attack-v19-name which, for sub-techniques, is formatted as <parent name>:<sub-technique name>. If you map to tactics, replace the tactics with the list from attack-v19-tactics. And if you use STIX IDs, replace attack-v18-stix-id with attack-v19-stix-id.

Step 2: Review straightforward Remaps (tactic changes only)

For techniques with the technique-change-type “remains technique” and “remains sub-technique”, the technique IDs have not changed. The only change resulting from updating the fields outlined in Step 1 above is the tactic(s) change for all techniques and a handful of technique name have been changed:

• T1211 is now “Exploitation for Stealth”
• T1222.001 is now “File and Directory Permissions Modification: Windows Permissions”
• T1222.002 is now “File and Directory Permissions Modification: Linux and Mac Permissions”

Step 3: Review the Revoked, Reissued, and Merged Techniques

A few techniques were revoked and reissued under new IDs or reorganized under new parent techniques. For these techniques, the tactics will change (similar to Step 2) but the technique IDs will also change. This covers any technique with the technique-change-type starting with “Revoked.”

Three legacy (sub-)techniques (T1562: Impair Defenses, T1562.001: Impair Defenses: Disable or Modify Tools and Impair Defenses: Indicator Blocking) were merged into a new technique, T1685: Disable or Modify Tools. T1685 revokes all three of the former (sub-)techniques. This covers the technique-change-type“Merged into new technique.”

Step 4: Review and Map to the New Techniques

Three new (sub-)techniques arose from the restructuring from the Defense Evasion split. The technique-change-type for these techniques are “Became a new sub-technique” or “Became a new technique.” The new (sub-)techniques are:

· T1687: Exploitation for Defense Impairment is the complement to T1211: Exploitation for Stealth (formerly named Exploitation for Defense Evasion). If you have existing mappings to T1211: Exploitation for Defense Evasion consider whether they should remain mapped to T1211 or be remapped to T1687 based on whether the adversary’s goal.

· T1686.003: Disable or Modify System Firewall: Windows Host Firewall is a new platform-specific sub-technique for T1686. Review any mappings to T1686 (formerly T1562.004) and re-map Windows specific mappings to T1686.003.

· T1684: Social Engineering is a new parent technique under which Impersonation and Email Spoofing have been moved as sub-techniques. If you’ve followed the steps above, your mappings for T1684.001 and T1684.002 will be good to go, since those techniques were revoked and reissued with new technique ids. And if you’ve been looking for a place to put other social engineering mappings, now you have one with T1684.

TL;DR

· If you want the fastest transition plan, start by updating the entries that only require a tactic change.

· Next review anything tied to T1562, revoked IDs, or merged content carefully, because these are the places where the there’s more significant restructuring.

· Finally, look at the newly introduced techniques and families, since they capture the deeper logic behind the split, in addition to the mechanics of ID changes.

AI & Social Engineering Techniques

We’re continuing to look at where ATT&CK coverage should expand, especially around adversarial uses of AI and social engineering. In both cases, the core question is the same: does this behavior create meaningfully different detection, defensive response or analytic requirements, or is it a variation of something already covered?

What changes across the matrix is the kind of value that coverage provides. In Reconnaissance and Resource Development, most of the activity happens outside the target environment, so the value of coverage is more centered on analytical and operational completeness than on direct detection. For techniques deeper in the post-compromise phases, distinct detection logic and defensive response requirements are critical. But question is the same for both pre-and-post. Does covering this behavior help defenders understand, track, and respond to adversary operations more effectively than not covering it?

For AI-enabled techniques, the key distinction is the behavior, not the tool. AI can make those activities faster, cheaper, and easier to scale, but it doesn’t fundamentally change what the adversary is doing (yet!). ATT&CK focuses on the behavior, so the coverage stays useful even as specific models and platforms change. For social engineering, the same logic applies, as adversaries have always tried to manipulate people into taking specific actions. Whether that happens over email, voice, or a help desk call, the channel is how the behavior is delivered, and the behavior itself is the manipulation. Treating that manipulation as its own behavior category makes it easier for defenders to track and respond to it, no matter how adversaries implement it.

This release adds new techniques that expand ATT&CK coverage on how adversaries use AI to scale and target research and content generation, and introduces a new parent technique for social engineering:

• On the AI-enabled front, T1682: Query Public AI Services covers how adversaries query public AI services for target research and operational planning at scale. T1683: Generate Content and its sub-techniques, T1683.001: Written Content and T1683.002: Audio-Visual Content, outline adversary content development, whether its created manually, sourced through third parties, or AI-assisted.
• On the social engineering side, we created a new parent technique, T1684: Social Engineering, to capture how adversaries use trust-based manipulation across multiple channels (email, voice, collaboration platforms, and help desk interactions) to prompt user-authorized actions like password resets, MFA changes, financial approvals, or sensitive information disclosure. Two existing techniques, T1684.001: Impersonation and T1684.002: Email Spoofing, were restructured as sub-techniques. The detection strategy for T1684 (DET0899) focuses on a common pattern with trust-manipulation behaviors, specifically how suspicious interactions are followed by an unusual user-authorized action (such as a password reset, OAuth consent grant, financial approval, or credential submission). Because that pattern holds across channels, defenders can build detection logic around the behavior itself instead of each channel variant.

Industrial Control Systems (ICS) | Getting Granular with Firmware, Communications, and Discovery Sub-Techniques

ICS sub-techniques have arrived, and the structural updates aim to make technique coverage more actionable.

Five new parent techniques were reorganized with sub-techniques:

1. T1693: Modify Firmware , separates system firmware (T1693.001) and module firmware (T1693.002) into sub-techniques, to reflect the different detection surfaces and integrity monitoring requirements.
2. T1695: Block Communications is an entirely new technique, that subsumed Serial COM (T1695.001) as a sub-technique, and now also includes two (new) subs, Ethernet (T1695.002), and Wi-Fi (T1695.003), with the three covering disruption at the physical and network layer.
3. T0846: Remote System Discovery gained three subs, now distinguishing Port Scan (T0846.001), Broadcast Discovery (T0846.002), and Multicast Discovery (T0846.003).
4. T0843: Program Download also gained sub-techniques that capture the distinct ways adversaries push modifications to programmable controllers, including Download All (T0843.001), Online Edit (T0843.002), and Program Append (T0843.003).
5. T1694: Insecure Credentials was added as a new technique, with Default Credentials (T1694.001) and Hardcoded Credentials (T1694.002) organized as sub-techniques to reflect the different ways adversaries abuse built-in credentials.

For the full picture of all (sub-) technique changes, check out the ICS crosswalk.

Using the ICS Crosswalk

Step 1: Update the Mapped Fields
For any row with record-type Existing Technique, start by replacing the old ATT&CK ID in attack-v18-attack-id with the value in attack-v19-attack-id. Then update the name from attack-v18-name to attack-v19-name. If the row includes a value in attack-v19-parent-attack-id, the technique now belongs under that parent in v19. If you use STIX IDs, replace attack-v18-stix-id with attack-v19-stix-id.

Step 2: Remap the Techniques that Became Sub-techniques
The most straightforward updates are the rows marked “Became new sub-technique”. These are direct remaps from old standalone techniques to new sub-techniques under a new parent. For these entries, you should replace the old technique ID with the new sub-technique ID and note the new parent.

Step 3: Review the Existing Parent Techniques
Some techniques are marked “Remains a technique”. These do not need to be remapped to a different ATT&CK technique ID. They just have new sub-techniques available. Review the sub-techniques to determine if you have enough detail to map to them.

Step 4: Add the New Parent Techniques
The crosswalk also introduces several rows with record-type “New Technique” and technique-change-type “Became a new technique”. These are the new parent techniques that organize the updated structure.

Defense | Detection Strategies Go Mobile

Last year we launched Detection Strategies, to give defenders practical, platform-specific guidance for detecting ATT&CK techniques. Each strategy connects adversary behavior to analytics, log sources, and tunable parameters, helping teams trace a clear path from technique to telemetry across different environments. With this release, the Defense and Mobile team started applying detection strategies to the Mobile domain. The Mobile detection strategies are designed to reflect that visibility is often uneven and depends on the tools defenders have in place. To address that, the guidance is vendor-agnostic and built to work across a wide range of visibility levels. It focuses on realistic signals defenders can observe, regardless of which mobile security products they use, and clearly calls out where visibility gaps remain and what telemetry or tooling would be needed to fill them.

Take T1398: Boot or Logon Initialization Scripts as an example. The prior guidance for T1398 told you Verified Boot, SafetyNet, and Knox could detect unauthorized modifications. That’s true, but not immediately actionable. The new detection strategy (DET0654) gives you two platform-specific analytics, explicit log sources, and tunable parameters, one for Android, one for iOS. That’s the difference between knowing something is detectable and knowing how to detect it.

• On Android, AN1739 focuses on boot persistence by surfacing suspicious changes to initialization components and linking them to script activity after startup. Indicators may include attestation failures, unexpected edits to protected init paths, or privileged processes starting from unusual locations.
• On iOS, AN1740 is designed to catch persistence that shows up through altered launch behavior. That can include unauthorized launchd changes or sideloaded apps that begin running automatically at boot or unlock, with signals such as modified plist files, binaries executing from non-Apple locations, or apps remaining active in unexpected background modes.

Detection strategies were completed for most Mobile techniques across Initial Access and Execution, and the remaining detection strategies will be included in the next release. If you would like to contribute to the Mobile detection strategy effort, let us know!

Cyber Threat Intelligence | From Tehran to Beijing, AI to Supply Chain, Cross-domain to Commodity tools

This release features coverage where we’re seeing operationally relevant activity tied to a number of spaces: Iran and the People’s Republic of China (PRC), early signals in AI-enabled tradecraft, cross-domain campaigns, software supply chain compromises, threats in underreported regions, and commodity crimeware.

• Iranian-linked updates include Void Manticore (G1055), the Ministry Of Intelligence Service (MOIS)-linked actor behind the Handala Hack, Karma, and Homeland Justice (C0038) personas, now targeting U.S. organizations including the 2026 Stryker Corporation attack; and MOIS-linked actor MuddyWater (G0069) was updated with software (MuddyViper (S9032), RustyWater (S9037), Fooder (9033)), reflecting continued tooling evolution with stealthier behaviors.
• Two entries mark emerging behaviors in AI-enabled threat activity: first up, a campaign entry for the Anthropic AI-orchestrated Campaign (C0062), capturing GTG-1002, an assessed People’s Republic of China (PRC) state-directed cluster, using Claude Code to autonomously execute most of a multi-stage espionage campaign. A software entry was added for LAMEHUG (S9035), the first malware documented to query a large language model in live operations, associated with APT28 (G0007).
• PRC-linked coverage expands in two directions: more visibility into known actors, and more depth around the infrastructure they exploit. We added MirrorFace (G1054), as a menuPass (G0045) subgroup, alongside its campaign, Operation AkaiRyū (C0060). The Volt Typhoon (G1017) entry reflects initial access broker updates, and new software entries (BRICKSTORM (S9015), BRUSHFIRE (S9011), SPAWNCHIMERA (S9024), PHASEJAM (S9014), DRYHOOK (S9013)) associated with PRC-nexus actors add to the Network Devices matrix and provide extended procedures on edge device targeting.
• Cross-domain coverage highlights that boundaries are just constructs, with the Hamas-affiliated threat actor WIRTE (G0090) pivoting to disruptive operations since October 2023, and the SameCoin (S9030) wiper added as a cross-domain entry spanning Enterprise and Mobile matrices. We also mapped the 2025 Poland Wiper Attacks (C0063) as a cross-domain ICS and Enterprise campaign, along with DynoWiper (S9038) and LazyWiper (S9039), documenting the first destructive wiper deployment against a NATO member’s energy infrastructure.
• Supply chain coverage expands around the familiar legitimate ecosystems being turned into delivery channels. GlassWorm (S9010), and Shai-Hulud (S9008), capture the 2025 npm ecosystem compromises that harvested developer credentials across hundreds of organizations, and TruffleHog (S9009) was included for its weaponized role within the Shai-Hulud infection chain.
• In Latin America, the financially-motivated APT-C-36 (G0099) continues to rely on commodity crimeware, reflected in the additions of HeartCrypt (S9018), and PureCrypter (S9019). SystemBC (S9012) was added to reflect its widespread use as a SOCKS5 proxy and persistent backdoor in ransomware operations, and the Evilginx2 (S9003) entry features an adversary-in-the-middle phishing framework used to capture authenticated session cookies and bypass MFA in real time. Qilin (S1242) now includes Linux support, capturing how its extending operations beyond Windows to target Linux infrastructure, including VMware ESXi servers.

For a full listing of the new Groups, Campaigns, and Software added as part of the release, check out the Release Notes.

Mobile | Spyware, Banking Trojans, and AI-Enabled Voice Phishing

The Mobile team coordinated with Defense to update detection strategies, and the matrix also gained three new software entries and an expanded technique.

VajraSpy (S9006) was added as a new Android spyware that is used in targeted espionage campaigns against Android users, capable of intercepting messages, exfiltrating contacts and files, and activating the device camera and microphone. DocSwap (S9005) is a new Android malware entry associated with Kimsuky (G0094), disguised as a document viewing app to covertly collect device information and exfiltrate data from targeted victims. Crocodilus (S9004) is added as a new Android banking trojan that hijacks accessibility services to display fake login screens over legitimate banking and cryptocurrency apps, stealing credentials and giving attackers real-time control of the device.

T1660: Phishing was updated to capture AI-enabled voice phishing, where adversaries use AI to clone voices to impersonate trusted individuals in real-time calls or urgent voicemails, making victims significantly more likely to hand over credentials, send money, or fall for other malicious actions.

Closing

As always, ATT&CK is a community effort, and this release reflects contributions, feedback, and conversations from defenders, analysts, and researchers across the community and we’re grateful for every one of them. If you spot something missing, have a correction, or want to flag a behavior we should be tracking, reach out. The framework stays useful because people tell us where it isn’t.

There’s more to come this year, and we’ll be publishing the Roadmap soon to provide more details on changes and additions across ATT&CK. ATT&CKcon 7.0 will take place October 27–28 and we’ll be releasing the Call For Papers in the next couple of months. We’re looking forward to hearing from the community on the research, operational insights, and use cases!

For the full picture of what changed in this release, head to attack.mitre.org. You can also connect with us via Email, or on LinkedIn, Slack, Bluesky, or X.

©2026 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited. 25–01291–2.

ATT&CK v19: The Defense Evasion Split, ICS Sub-Techniques, New AI & Social Engineering Coverage… was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

If you’ve been following the ATT&CK community channels, you’ve probably heard us talking about changes to Enterprise’s Defense Evasion tactic (ATT&CKcon 5.0, ATT&CKcon 6.0, #att&cking-mondays on Slack, etc). Those changes are almost here, with the release of ATT&CK v19 coming on April 28th. This post walks through what’s changing, why, what’s shipping in April, and what’s still ahead.

A Tactic Divided Against Itself

It was the best of tactics and the worst of tactics.

Defense Evasion has been one of the most heavily used tactics in ATT&CK, and sometimes one of the most frustrating to work with. It wasn’t wrong, per se. Adversaries want to stay hidden, and they continue to find creative, layered ways to accomplish that. The problem is that ‘evading defenses’ turns out to describe two fundamentally different things, and Defense Evasion treated them as one. It was doing too much at once, which it means doing none of it clearly enough.

With over 40 techniques under a single umbrella, Defense Evasion became something of a catch-all. A behavior landed there if it was evasion-adjacent, regardless of what the adversary was actually doing. Some of those techniques are about blending in, like making malicious activity look like the thousand other normal things happening on your network at any time. Others are about something more aggressive: finding your security tools and breaking them or compromising their integrity.

Hiding and breaking are not the same behaviors and treating them as one means defenders have been trying to answer two completely different questions with the same playbook. When everything lives in the same bucket, you lose clarity. And when you lose clarity, you lose prioritization.

If you’ve ever tried to explain adversary intent using Defense Evasion, or map your detection coverage to it, you’ve probably felt that tension. Not all evasion is the same. It just looked that way because we were describing it with one word.

Two Tactics: One Adversary, Two Completely Different Problems

Walk through a real attack and the distinction quickly obvious.

An adversary gets in and starts moving through your environment. They start by using native system utilities to run their tools: rundll32.exe, msiexec.exe, the same living-off-the-land binaries that show up in your telemetry every single day. Your EDR is running, your SIEM is collecting, your defenses are fully intact. But the adversary is indistinguishable from the normal behavior. They are operating below the detection threshold by blending in.

That’s Stealth.

Later in the operation, that same adversary disables your logging pipeline, and tampers with your EDR agent, so it stops reporting. Now your defenses aren’t just fooled, they’re broken. The tools that would have caught the next action are no longer reliable.

That’s Impair Defenses.

One operation with two different intents. And two completely different defensive responses.

Stealth is about hiding from your defenses. Impair Defenses is about breaking them.

This distinction isn’t semantic; it’s the difference between needing better behavioral analytics and needed better tamper protection. Between asking “why does this look like normal activity?” and “why did my EDR stop reporting?” Conflating the two in a single tactic means the community has been trying to answer both questions with the same philosophy.

It Is a Far Better Thing: Stealth and Impair Defenses

We’re replacing Defense Evasion in the Enterprise matrix with two tactics, Stealth and Impair Defenses, each scoped to adversary intent.

Stealth captures techniques where adversaries reduce their visibility or make malicious activity indistinguishable from legitimate behavior. The defining characteristic is that your defensive systems are still working, the adversary is just operating in ways that look normal.

Examples include:

• T1564: Hide Artifacts: concealing files, users, or processes from standard system views
• T1027: Obfuscated Files or Information: encoding or encrypting payloads to avoid static detection
• T1218: System Binary Proxy Execution: abusing trusted Windows utilities to proxy malicious execution
• T1036: Masquerading: disguising malicious files or processes as legitimate system components

For defenders, Stealth techniques require a different response, one that is fundamentally analytic. Your tools can see these behaviors; the problem is distinguishing what looks benign from what’s actually malicious. That’s a behavioral analytics, anomaly detection, and forensic analysis response.

Impair Defenses is what happens when adversaries stop hiding and start breaking things. Techniques in this tactic actively degrade, disable, or compromise the integrity of security controls and monitoring infrastructure. The adversary’s goal here is to make your defenses less reliable, or to eliminate them entirely.

Examples include:

• T1562.001: Impair Defenses: Disable or Modify Tools: stopping, uninstalling, or tampering with endpoint security agents.
• T1553.004: Subvert Trust Controls: Install Root Certificate: subverting trust controls at the certificate layer.
• T1222: File and Directory Permissions Modification: altering access controls that govern what defenders can see.

Defending against the techniques in Impair Defenses requires a different mindset entirely: integrity monitoring, tamper protection, and continuous validation of your security controls. These techniques are designed to invalidate the assumption that your defenses are working. If you aren’t testing that assumption regularly, you may not know they’ve succeeded.

A Tale told in Multiple Parts: What’s Shipping in April

This is a phased change, and we want to be transparent about both the process and the timeline. April is a chapter.

Restructuring something as foundational as a tactic requires every technique to be reviewed against the same question: What is the adversary trying to do? Hide? Break your tools? Both? Neither/does this behavior belong somewhere else entirely? For the April release, the goal is to get the structural reorganization in place without burying the community in simultaneous content changes.

TLDR:

Most Technique IDs aren’t changing. For most techniques moving to Stealth or Impair Defenses, the only change will be the associated tactic(s). Technique IDs, behavior descriptions, procedures, and detection logic are unchanged/carried over.

3 techniques are moving out of the former Defense Evasion space entirely. Techniques leaving the tactic may have updated descriptions and remapped procedures to better reflect their actual scope. More detail on these techniques in the crosswalk that will be included with the April release.

The most significant structural update centers on T1562: Impair Defenses. The parent technique is being retired, and the concept now lives at the tactic level. The sub-techniques are being reviewed and realigned accordingly.

Email Spoofing and Impersonation techniques are being reorganized under a new Social Engineering technique. More detail on that in the April release post.

Tactic IDs are splitting. Stealth will inherit Defense Evasion’s existing tactic ID (TA0005) and Impair Defenses, as a net-new tactic, will be assigned a new ID.

Enterprise-only change. While rooted in common ground, the Enterprise, Mobile, and ICS matrices are distinct from each other and continue to develop independently. The tactics in Mobile and ICS will remain unchanged in the April release.

What This Means for Defenders

Don’t panic about your mappings (they’re still mostly valid). If you’ve mapped detections or controls to specific technique IDs, some adjustments may be needed for the April release. We’ll provide a crosswalk in the release notes and blog for the full picture of changes.

Think in terms of adversary intent, not just behavior. The Stealth / Impair Defenses split is most useful when you ask: is the adversary hiding, or are they breaking something? Those are different threat models that need different responses.

Impair defenses often goes unmeasured. If your EDR agent is tampered with and stops reporting, how fast do you know? Building detections around the absence of expected signals is one of the most underinvested areas in enterprise defense.

The Work of Many Seasons: What’s Still Coming

You’ll continue to see restructuring in future releases: updated technique descriptions, scope realignment, additional procedure mappings, and deprecation of techniques that no longer represent distinct behaviors. We know this realignment creates work for the community, and we’re committed to being deliberate and not (overly) disruptive. More detail on specific technique changes will be included in the April release notes.

As always, we want your feedback. Reach out at attack@mitre.org or join the conversation in the ATT&CK slack channels and stop by #att&cking-mondays. We want to hear your thoughts, what’s still unclear, and where you think we can push next.

©2026 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited. 26–00722–1.

Defense Evasion Split: A Tale of Two Tactics was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

ATT&CK v18: The Detection Overhaul You’ve Been Waiting For

We’ve spent the last six months focused on making ATT&CK more usable and actionable for defenders, and with the help of the community the results are here!

First, we’re excited for you to finally experience the detection overhaul with two new ATT&CK objects, Detection Strategies and Analytics, that shift guidance from single-sentence notes to structured, behavior-focused strategies. Workbench now supports Detection Strategies, so upgrade your instance to take full advantage of the defensive updates.

Across domains, we’ve deepened coverage of threats organizations are facing today. Enterprise adds techniques for modern infrastructure, Kubernetes, CI/CD pipelines, and cloud databases, along with ransomware preparation behaviors and adversaries monitoring their own threat intel. CTI features new groups, campaigns, and software tied to cascading supply chain compromises, cloud identity abuse, and attacks on edge and virtualization systems, and includes expanded content on the Democratic People’s Republic of Korea (DPRK) and People’s Republic of China (PRC) operations.

On the Mobile front, there’s coverage of state-sponsored abuse of Signal/WhatsApp linked devices and enhanced account collection techniques. And in ICS, new and updated Asset objects expand the range of industrial equipment and attack scenarios ATT&CK can represent, including improved connections across sector-specific terminology through Related Assets.

Looking into the future, we’re launching the ATT&CK Advisory Council to formalize community input on the framework’s direction and yes, we’re already working on v19.

For all the details on our updates/additions across Techniques, Software, Groups and Campaigns take a look at our release notes, our detailed changelog, or our changelog.json.

Defensive

As Lex Crumpton discussed in-depth in her recent blog post on Medium, and presented on a couple of weeks ago at ATT&CKcon 6.0, we’re upgrading how ATT&CK handles detection, and if you’re building detections, integrations, or automation on top of ATT&CK data, hopefully you’re tracking the updates. The new ATT&CK guidance renovates detections from single-sentence notes into structured, behavior-driven strategies to reflect how adversaries move through environments. It’s a work in progress, and we know there’s always room to improve, but we think it’s a major step toward making ATT&CK more usable and detection engineering-aligned.

TLDR: We’re introducing two new ATT&CK objects, Detection Strategies and Analytics, that replace the old detection fields and relationships you might be used to. Techniques now connect to Detection Strategy objects that point to platform-specific Analytics, which then link to Log Sources and Data Components. Log Sources aren’t separate objects anymore, they now live directly on Data Components.

Our goal with this approach is to better support defenders in detecting how attacks actually happen. Adversaries don’t trip a single alert and call it a day, they move through your environment in stages, and our detection guidance needs to reflect that reality. The new model breaks down detection into modular pieces where Detection Strategies describe what behavior you’re looking for, Analytics give you platform-specific guidance with tunable settings, and Log Sources use clear naming (like wineventlog:security or auditd:SYSCALL) so you know exactly what telemetry you need. If you’ve built tools that rely on the old detection fields, you’ll need to update them, but Workbench will support the new Detection Strategies right away, and we have sample STIX files, schemas, and compatibility resources on GitHub to help.

Enterprise

For this release, we focused on enriching and upgrading what’s currently in ATT&CK, and were more deliberate about building out the new behaviors to reflect some of the targets we’re seeing adversaries exploit, including Kubernetes clusters, DevOps workflows, and the automated infrastructure running your business.

T1059.013: Command and Scripting Interpreter: Container CLI/API captures adversaries using Docker CLI, Kubernetes APIs, and container SDKs to execute commands, pull images, spin up pods, and steal cloud credentials. Before they strike, T1680: Local Storage Discovery shows them mapping drives, volumes, and storage across systems, hypervisors, and cloud platforms to set up maximum disruption. T1213.006: Data from Information Repositories: Databases covers adversaries raiding MySQL, PostgreSQL, RDS, Azure SQL, and other databases for credentials, PII, and financial data. T1677: Poisoned Pipeline Execution documents how they poison CI/CD pipelines by modifying configuration files, corrupting build scripts, or crafting malicious pull requests that leak secrets and inject compromised components.

T1546.018: Event Triggered Execution: Python Startup Hooks shows adversaries exploiting Python’s startup mechanisms through .pth files and sitecustomize.py to maintain persistence in DevOps and automation workflows. T1562.013: Impair Defenses: Disable or Modify Network Device Firewall captures them breaking into firewall consoles to disable protections or create openings for C2 and exfiltration. T1036.012: Masquerading: Browser Fingerprint documents them spoofing User-Agent strings and browser attributes to make malicious traffic look legitimate and evade behavioral analytics. T1518.002: Software Discovery: Backup Software Discovery formalizes how ransomware operators hunt down Veeam, Acronis, Paragon, and other backup tools before launching attacks. T1679: Selective Exclusion captures them carefully avoiding .dll, .exe, and critical system files during encryption to keep systems functional enough to display ransom notes. T1681: Search Threat Vendor Data documents how adversaries are monitoring threat intel about their own campaigns, replacing infrastructure within days of exposure, and overall treating public reporting as real-time feedback on their detection footprint.

Looking Forward

We’re wrestling with some interesting challenges as we plan future updates, and we’d love the community’s input on where to draw some lines:

· Adversary use of AI, beyond just “obtaining” It

Right now, T1588.007: Obtain Capabilities: Artificial Intelligence captures adversaries acquiring AI tools and models, but we’re seeing reporting that suggests they’re using AI and LLMs for way more than just resource development. The question is: what other tactics are they leveraging AI for in meaningful ways? We need more data to categorize how AI use is shifting from assistance to operational use during intrusions.

· Where to draw the line on Social Engineering

Social engineering has always been tricky territory for ATT&CK because it spans so many behaviors. We’ve got some coverage already (Phishing, Phishing for Information, User Execution, Impersonation, Malicious Copy Paste (ClickFix) technique) but the challenge is deciding which social engineering behaviors deserve their own techniques versus which ones are just variations of existing coverage. Social engineering is fundamentally about manipulating people, so many initial access or credential theft behaviors have some social engineering component. How do we determine what’s distinct enough to warrant inclusion?

Defense Evasion Split, Beta Version

Over time, Defense Evasion has become a catch-all for too many distinct behaviors, so we’ve been talking about how to rescope for over a year now (at the last two ATT&CKcons and ATT&CKing Mondays). We took the first stab at splitting the Defense Evasion tactic into two new tactics that better reflect what adversaries are doing, and how to better detect it.

Two Tactics Instead of One

We’re proposing to split Defense Evasion into Stealth and Impair Defenses.

· Stealth would capture techniques where adversaries change what defenders see in their tools, like email hiding rules, hidden users and files, building images on host to avoid registries, impersonation, breaking process trees, and using unsupported or unused cloud regions. These are behaviors about blending in, and manipulating the data that shows up in your monitoring tools.

· Impair Defenses would cover techniques where adversaries actively sabotage your security controls, which would include all the current “Impair Defenses” sub-techniques, as well as behaviors like conditional access policy modifications, code signing policy changes, most of “Indicator Removal,” domain or tenant policy manipulation, and subverting trust controls. These are direct attacks on your defensive infrastructure.

Shuffling Techniques to Better Homes

This will also provide an opportunity to move the techniques that never quite fit Defense Evasion in the first place. Two sub-techniques under T1448: Abuse Control Mechanism, T1548.006: TCC Manipulation and T1548.005: Temporary Elevated Cloud Access, are heading to Privilege Escalation, and T1197: BITS Jobsand T1578.005: Modify Cloud Compute Infrastructure: Modify Cloud Configurations are moving to Persistence since that’s their primary purpose. We’re also rethinking how to make Process Injection more effective, potentially by breaking it into Process Redirection and Process Injection under Execution because that’s fundamentally what’s happening. DLL Sideloading, Reflective Code Loading, and Hijack Execution Flow would also moving to Execution too. And everyone’s favorite technique, Valid Accounts, would get pulled from Defense Evasion entirely. Last but not least, we’re proposing to delete Modify Registry and Rootkit as standalone techniques since they’re better captured elsewhere or are too broad.

We Want to Hear From You!

This is a significant restructuring of how ATT&CK organizes adversary behavior, and we’re not doing it in a vacuum. Does this split make sense for how you’re seeing attacks unfold? Are there techniques we’re moving that should stay put, or ones we’re keeping that should move? Does the Stealth versus Impair Defenses distinction map to how you think about detection and response?

Cyber Threat Intelligence

This release focuses on the threats coming at us from all directions, from geopolitical operations, fast-moving cybercrime, and the tools that keep both moving. We added six new threat groups and expanded several existing ones to reflect how these adversaries are adapting, as well as 29 new Software tools, and five new Campaigns.

We’re seeing supply chain compromises cascade across ecosystems, with C0057:3CX Supply Chain Attackbeing a prime example, where G1049:AppleJeus turned one trusted dependency into another foothold. To capture how cybercriminals and ransomware groups continue to adopt more flexible Ransomware-as-a-Service models and shared tooling, new groups and software include G1051:Medusa Group (S1244:Medusa Ransomware), G1053:Storm-0501 (S1247:Embargo Ransomware), and G150:Water Galura (S1242:Qilin Ransomware). We also added S1240:RedLine Stealer, a Malware-as-a-Service infostealer sold to Initial Access Brokers whose stolen credentials fuel further intrusions. Identity remains a high-pressure battleground, and the updated G1015:Scattered Spider entry highlight how the group keeps proving that social engineering beats perimeter defenses, by impersonating IT staff, bypassing MFA, and reaching into Okta, AWS, and Office 365. The new C0059:Salesforce Data Exfiltration campaign shows how UNC6040 used vishing to get into corporate Salesforce environments, followed by UNC6240 extortion under the “ShinyHunters” name.

With adversaries pushing into the parts of the network hardest to see, the edges, we added G1048:UNC3886 leveraging zero-days and custom malware against routers and virtualization platforms, documented in the C0056:RedPenguin campaign. And C0058:SharePoint ToolShell Exploitation shows how actors like Storm-2603, G0027:Threat Group-3390, and G0128:ZIRCONIUM moved quickly against newly disclosed server-side vulnerabilities across multiple sectors and regions. We’ve also expanded coverage of the Democratic People’s Republic of Korea (DPRK) and People’s Republic of China (PRC) operations. From AppleJeus and G1052:Contagious Interview driving cryptocurrency theft, to G0129:Mustang Pandarefining espionage tooling with six new malware families. And in the Quad7 Activity campaign, China-linked operators use compromised SOHO routers for password spraying against government, NGO, and defense organizations.

For all of the updates across CTI, check out the release notes.

Looking Forward

We’ll continue tracking the professionalization of cybercriminal operations, the growing convergence of cybercrime with state-backed activity, and the shift toward cloud identity, SaaS services, and edge infrastructure. We’re also expanding our geographic and sector coverage to address gaps in underreported regions. To better reflect how adversaries operate and connect, we’ll be assessing how to refine our approach to describe group relationships, shared infrastructure, and attribution complexity, to help inform defense strategies. In line with the Workbench updates, we’re prioritizing faster intelligence cycles for more rapid CTI releases.

We’d like to thank all of the contributors who provided research, data, and time to help us capture these Groups, Campaigns and Software. We truly appreciate the time and expertise the community brings to ATT&CK, and look forward to collaborating with you for the next release!

Mobile

We’ve made some focused updates to Mobile ATT&CK in this release based on what the community has been asking for and what we’re seeing across the domain.

Similar to how we brought back T1451: SIM Card Swap in v17, we’ve reintroduced T1453: Abuse Accessibility Features after hearing from the community and tracking multiple reports showing how adversaries are leveraging accessibility features across different attack scenarios. We’ve also added T1676: Linked Devices, which captures something we’re seeing more of: adversaries conducting cross-domain operations that span Enterprise and Mobile environments. Threat actors are abusing the “linked devices” feature in apps like Signal and WhatsApp to register a victim’s account on attacker-controlled devices. They phish users into scanning malicious QR codes, often disguised as group invites or security alerts, which links the account to their infrastructure. Once connected, adversaries can then persist through the victim’s account, access messages and contacts, and send messages from the linked device. We’ve observed this in the wild with groups like G0034:Sandworm Team targeting Signal accounts on devices captured on the battlefield and G1033:Star Blizzard connecting WhatsApp accounts to adversary infrastructure for message exfil.

Finally, we’ve added T1636.005: Protected User Data: Accounts to capture how adversaries collect account data from compromised devices. On Android, this means abusing the AccountManager API to list accounts; on iOS, it’s leveraging Keychain services. If devices are jailbroken or rooted, adversaries can access this information without users ever knowing. We’re seeing this in malware like S1243:DCHSpy and S1241:RatMilad, which gather account names and types as part of their collection routines. These updates, along with new software entries for threats like S1225:CherryBlos (an Android credential stealer targeting cryptocurrency), S1231:GodFather (banking malware using virtualization to mimic legitimate apps), aim to provide better coverage of what we’re seeing in the threat landscape and what we’re hearing from the community.

Looking Forward

Our goal is to continue working closely with vendors and the security community to add critical new techniques and refine existing ones so they’re more actionable and reflect real-world threats. We’ll also be upgrading mitigations with more detailed, practical guidance and expanding on mobile-specific CTI, from mobile malware to OS vulnerabilities to adversarial abuse of platform-level services. And we’ll be partnering with the Defense team to bring the new Detection Strategies model to Mobile, and provide the same structured, behavior-driven detection guidance for mobile threats.

ICS

For this release, we created new Asset objects and updated existing ones to expand the set of ICS equipment that ATT&CK can represent. Assets, operational devices and infrastructure in ICS networks, have been part of ATT&CK for a while, but naming varies across sectors. This can make it difficult to reference the same device consistently, so we’ve been building out the Related Assets field, which links sector-specific terminology based on similar functions, architectural placement, and exposure to adversary techniques. These updates also provide examples of other equipment you may encounter, even if it isn’t designated as a core Asset object, helping you identify devices in your own environment. Each related asset includes a name, optional sector identifier, and a short description for added context.

We also clarified descriptions for existing assets like A0009:Data Gateways and A0006:Data Historians to better reflect their capabilities. And we updated platform fields to mirror real-world configurations more accurately. For example, a router has an embedded operating system and serves as network equipment, so it maps to both embedded and network platforms.

Our three new Assets include:

A0017: Distributed Control System (DCS) Controller
Represents microprocessor units managing large-scale, continuous industrial processes (e.g., chemicals, manufacturing, oil and gas). DCS Controllers operate within coordinated networks of controllers, software, and operator stations and are typically programmed using IEC-61131 languages. Related assets include Field Device/Controller (general function) and Programmable Logic Controller (PLC), which offers similar functionality but usually with less advanced control capability.

A0016: Firewall
Represents gateways enforcing network access policies. In ICS environments, firewalls are critical for segmenting ICS from business networks, restricting ingress and egress, and defining security zones to limit adversary movement. Related assets include Boundary Firewalls (between Purdue levels) and Device Firewalls (device-level protections).

A0015: Switch
Represents network devices that connect endpoints, including workstations, servers, Human-Machine Interfaces (HMIs), and PLCs, and forward traffic at OSI Layer 2 or 3 using MAC or IP addresses. Switches typically define network segments within Purdue levels. Related assets include Core Switches, Access Switches, Layer 2/3 Switches, and Distribution Switches.

Looking Forward

Moving into 2026, we’ll be working to update detections to match the new detection strategies model, refreshing CTI content (including new software, groups, and cross-domain campaigns), and expanding Asset coverage into more sectors and system types. We’ll also keep refining techniques, adding sub-techniques where it makes sense, and incorporating community contributions.

Software

We’ve been working to support the major STIX updates to Data Sources and Data Components introduced in this release, particularly the new detection strategies model. If you’re running your own ATT&CK Workbench instance, you should upgrade to the latest version to take advantage of the new detection strategies support and other improvements in this release.

Visit the ATT&CK Workbench repository on GitHub for upgrade instructions and release details.

Looking Forward

The team will continue to restructure our development approach to maintain a higher tempo for Groups and Software updates independent of ATT&CK’s biannual release cycle, to allow us to get threat intelligence updates out to you faster while managing more complex changes at their own pace.

What’s Next for ATT&CK

Advisory Council

ATT&CK has always been community-driven, shaped by your research and data, real-world experience, and your needs as defenders. We take our role as stewards seriously, and we’ve long thought about a more formal channel that reflects how the community’s input directly informs ATT&CK’s direction. That’s why we’re excited to launch the ATT&CK Advisory Council.

The Council will provide a structured channel for the strategic input our community has always given, from advising on emerging threats and industry needs, and sharing perspectives on roadmap priorities, to helping us keep the framework grounded in real-world defense. Members will represent a diverse set of stakeholders, end users from major industries, vendors integrating ATT&CK into their products, government organizations, and academia. Advisors will be technical leaders committed to benefiting the global cybersecurity community and will serve staggered terms to ensure continuity. The Council will complement, not replace, the existing CTID Advisory Council and Evals Vendor Forum.

This is the first step, and we want you to be involved. We’ll be refining the structure and engagement approach with the community, and we welcome your ideas on how ATT&CK governance and communication can best support you. Our commitment is to ensure that ATT&CK continues to be a public resource that serves defenders first, and this Council is one of the ways that we’re formalizing that commitment.

V19 Release

We’re already working on v19, incorporating feedback from this release, tracking threats, and refining the Detection Strategies model for Mobile and ICS. The work doesn’t stop between releases, and we’re constantly evaluating new intelligence, assessing technique proposals, and collaborating with vendors, researchers, and practitioners to make sure the next update reflects what you need. If you’ve submitted contributions or have ideas for what should be prioritized, we’d like to keep those conversations going.

As always, we’d love to connect with you on Email, Bluesky, LinkedIn, or Slack.

©2025 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited. 25–01291–1.

ATT&CK v18: Detection Strategies, More Adversary Insights, was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

Updated: October 22, 2025

Key updates:

- Website example images added
- No more Log Source SDO → log sources now live as a x_mitre_log_sources field on the Data Components SDO.
- No more <detects> SRO between Data Components and Techniques → Techniques now map to Detection Strategy SDOs.

Defenders have often used the information in ATT&CK Detections to help build useful analytics. But as detection engineering has matured, the current format hasn’t always scaled well. The text in ATT&CK’s Detections often packed too many behaviors into a single block of text, making them hard to interpret or apply. Important platform differences were sometimes lost, and mapping from an adversary behavior to log telemetry, especially in complex environments, was more art than science.

Prepare to scale your mappings.

We’re rolling out a significant adjustment to the ATT&CK STIX format and ATT&CK Workbench in the v18 release, with the introduction of two brand new STIX Domain Objects (SDOs) and a structured relationship model. This update will transform ATT&CK detection guidance into a detection strategy-focused system, with modular, behavior-first blueprints that better address adversary behavior, platform diversity, and scalable detection.

Why Change at All?

Detection strategy has always been a core part of ATT&CK, but the way we captured that guidance didn’t always reflect how defenders, including us, work in practice. Earlier versions used the x_mitre_detection STIX field within a technique to describe detection suggestions. This combined platforms, behaviors, and telemetry sources into a single paragraph, which could be challenging to automate or tailor to different environments.

We later moved to what’s currently in ATT&CK, with detection logic structured into detects relationships between data components and techniques. This helped highlight the connection between telemetry and detecting specific techniques, but the relationships typically lived in unstructured description fields that lacked visibility and can’t be versioned on their own. This has led to a key challenge as ATT&CK has matured: some of our most valuable detection insights are being buried.

The x_mitre_detection_strategy

This challenge made us take a step back to consider how to capture detection strategy in a way that actually reflects how intrusions happen, and how defenders think. Most detections have also relied on isolated events: one process creation, one file write, one network connection.

But adversaries don’t operate in one-liners.

Modern detection strategy isn’t about one-liners, it’s a series of detections. Real-world intrusions unfold across multiple events: a process writes a file to a temporary directory -> that file is encrypted via a known library -> the file is exfiltrated over a suspicious channel.

We knew we needed a better way to capture and express that kind of logic. So, we’re rebuilding the detection model around a simple principle: detection strategy isn’t a sentence, it’s a system. With this new system, we broke detection logic into modular STIX objects, each with its own lifecycle and version control, tailored to specific platforms, and logically connected to behaviors, telemetry, and analytics. The objects describe what behavior to look for, where to find it in logs, and how to tune the detection to your environment.

Detection strategies now capture those multi-event, cause-and-effect behavior chains, not just tool-specific signatures. Each strategy acts as a blueprint. It doesn’t tell you exactly how to write a SIEM rule tailored to your environment, but they give you:

· What behavior to observe

· What log data you need

· What parameters are tunable

· What parts are fixed and ATT&CK technique-defining

Key Detection Architecture Changes

The detection strategies model introduces three major changes:

1. Detection Strategies Link to Techniques

Each x_mitre_detection_strategy object corresponds to one ATT&CK technique or sub-technique and defines what adversary behavior it’s intended to detect. It does not contain all the detection logic itself, instead, it references one or more Analytics that describe how to detect the behavior in different environments.

2. Analytics Are Platform-Specific and Actionable

Previously, detection notes tried to explain Linux and Windows behavior in a single field. Now, each Analytic is platform-specific, with direct references to required Log Sources, Data Components, and tunable detection thresholds. That means one Detection Strategy for T1048.001: Exfiltration Over Symmetric Encrypted Protocol might include:

· AN-2301: Detect encrypted file transfer over SFTP on Linux

· AN-2302: Detect non-C2 TLS exfiltration from PowerShell on Windows

3. Data Components are Explicit and Reusable

Instead of saying “use Sysmon,” ATT&CK will now tie Data Components to Log Source name and description that contain Data Component specific permutations:

These log sources are then tied to Data Components through formal STIX relationships, creating a clear chain from behavior to telemetry.

Each new STIX object plays a precise role:

These fields allow ATT&CK to define multi-event, platform-specific detection logic that is abstract enough to be reused and specific enough to be actionable.

Here’s how the new detection strategy model works in practice, moving from high-level strategy to low-level detection components:

1. Each detection strategy includes three key elements: a Detection Strategy ID, a Detection Strategy Name, and one or more associated Analytic IDs.

2. Each analytic includes five key elements: its ID, Platform, Detection Statement, Log Source, and Mutable Elements, capturing platform-specific logic, relevant telemetry, and tuning options.

3. At the next level, each Data Component will have a list of Log Source permutations that defines a Log Source Name and Channel. Mutable Elements outline fields and descriptions that help you tune the detection logic to fit your environment.

At its core, a Log Source Name is broken down into two parts:

• PRE represents where the telemetry originates. This includes the platform, environment, or context of collection — for example, Windows, Linux, macOS, cloud environments, or containers.
• POST represents what specific data stream or feed is being collected from that source, such as the channel, component, or feed within that platform.

Together, the PRE and POST form a structured name such as:

• wineventlog:security — Windows Event Log Security Channel
• auditd:SYSCALL — Linux auditd system call events
• macOS:unifiedlog — macOS unified logging stream

Each log source also defines a Channel, which identifies how to interpret or filter the telemetry. This includes:

• Event IDs — numerical identifiers such as 4624, 4625, or 4688 for specific Windows events.
• Operations — API-level actions, such as execve or CreateProcess.
• Match strings — descriptive identifiers or patterns found within telemetry, such as a “new HID device enumeration with type keyboard.”

When combined, these fields (EVENT, OPS, MATCH) define the detection context that analysts and tools can use to correlate behaviors across systems.

In short, the PRE:POST naming convention ensures that each log source is both platform-aware and data component–specific, while the Channel and Event/Operation/Match fields enable flexible, detailed mapping of behavioral evidence across diverse telemetry sources.

Each analytic includes tunable thresholds, suspicious tool lists, or time windows to tailor detection logic without changing core behaviors.

Example: T1027: Obfuscated Files or Information

Detection Strategies Use Case

Let’s say your team wants to detect T1053.002: Scheduled Task/Job: At execution on Windows, Linux, and macOS:

1. Retrieve DET-0084, which links to:

· AN-3121 for Windows (EventID 4698 + file write to %SystemRoot%\Tasks)

· AN-3122 for Linux (cron log + /var/spool/cron/ file write)

· AN-3123 for macOS (launchd with file drop in ~/Library/LaunchAgents)

2. Confirm that relevant Data Components (DC-0033, DC-0037, DC-0039) are collected in.

3. Adapt thresholds, as needed:

· Extends TimeWindow to 30 mins

· Flags execution outside of working hours (UserContext: !System)

4. Test the detections using an adversary emulation tool or ATT&CK Workbench scenario runner.

What You’re Probably Also Wondering: How Will This Affect Me?

We know change can be disruptive, but it’s also an opportunity to clean up any overlapping detection logic, fine-tune your alerts, and better align your detections to how adversaries move through environments. If you’ve built integrations, dashboards, or automated pipelines on top of ATT&CK data, this update will affect you.

Will this break my existing ATT&CK integrations?

If you rely on x_mitre_detection, descriptions with a relationship_type:”detects”, or x_mitre_data_sources, yes.

Are data sources going away?

Not fully. They will be there in older versions of ATT&CK, but after October 2025 we will be moving to Log Sources instead.

What if I don’t have the log sources listed?

That’s okay. Each detection strategy includes tunable fields and platform-specific options so you can adapt the logic to what you do have.

How does this impact ATT&CK Workbench?

Workbench will support authoring and visualizing x_mitre_detection_strategy objects out of the box. You’ll be able to map detection strategy coverage across tactics, platforms, and data collection.

When do I get sample STIX to test against?

Please visit our Github for the STIX example to test against. These will align with the same version of Workbench.

Where/when can I see the full schema?

Please visit our Github for the STIX Schemas (Detection Strategy, Analytics, and Data Component). For instructions on how to install our TypeScript parser library please visit the Attack Data Model . For insight into our compatibility document, please visit our Github.

Final Thoughts

We’ve learned a lot from how the community, and our own teams, approach detection, and this update reflects that learning. By moving from single-sentence guidance to structured, behavior-driven strategies, we’re aiming to make ATT&CK more usable, adaptable, and aligned with how adversaries actually operate.

The new model is a work in progress, and we know there will always be room to improve. But we think it’s another step in the right direction, and we’re excited to keep advancing it with your feedback.

How You Can Contribute

This isn’t a closed-door update, we want your input!

Whether you’re spotting gaps, have great ideas, or just curious how others are thinking through this update, your perspective helps shape where we go next. We’d be happy to hear from you at attack@mitre.org, in our Slack, or stop by ATT&CKing Mondays there for help, demos, or migration guidance.

©2025 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited. 25–01296–1.

What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

Our goal with ATT&CK v17 is to help defenders stay aligned with where adversaries are headed by looking at where they’ve recently been. This release aims to inform defensive efforts by focusing on the platforms adversaries are exploiting, the techniques they’re adapting, and the environments they’re targeting.

• Enterprise now includes the ESXi platform, reflecting the rise in attacks on virtualization infrastructure. We also renamed the Network platform to Network Devices (because let’s call things what they are).
• On the Defensive side, we’ve made Data Components more useful, showing you how to collect, not just what, with platform-specific tips and tools. Mitigations also got an upgrade, with more guidance, real-world examples, and integration tips.
• We updated content for Mobile, including five new tools and a cross-domain campaign, spotlighting both current and emerging threats to the space.
• In CTI, we’re tracking more Groups, Campaigns, and Software that focus on state-directed and criminal operations targeting diverse environments with versatile tools aimed at both data theft and disruption.
• We’ve updated the mitreattack-python library to work with ATT&CK v17 STIX content, and shifted Workbench to semantic versioning, to streamline and let you preview some major upcoming changes.

For all the details on our updates/additions across Techniques, Software, Groups and Campaigns take a look at our release notes, our detailed changelog, or our changelog.json.

Enterprise | ESXi, Network Devices, and Novel Behaviors

With this release, we’re adding a new platform to ATT&CK: ESXi. As adversaries increasingly target virtualization infrastructure due to its broad adoption and high-impact potential, we’re focusing on a platform adversaries have recently been focused on too, the VMware ESXi hypervisor. This update adapts 34 existing techniques to the ESXi environment and introduces four new techniques designed for it:

· T1675: ESXi Administration Control

· T1059.12: Command and Scripting Interpreter: Hypervisor CLI

· T1505.006: Server Software Component: vSphere Installation Bundles

· T1673: Virtual Machine Discovery

The platform scope centers around the core operating system of the ESXi hypervisor, with primary attention on the hypervisor itself, rather than vCenter Server which manages ESXi hosts. Techniques involving vCenter are only included when they directly impact ESXi, such as using vCenter to compromise the hypervisor. While we initially considered creating a broader type-1 hypervisor platform, in the wild reporting on adversaries has been heavily focused on ESXi. ESXi is also unique in that it leverages a custom kernel and operating system rather than relying upon an existing ATT&CK platform such as Linux (e.g, Xen) or Windows (Hyper-V) for behind-the-scenes management. The virtualization landscape will continue to change, and while ESXi’s role may shift, attackers have been actively leveraging its capabilities, especially in ransomware and persistent access campaigns. As other hypervisors draw in more adversaries, we’ll work with the community to ensure that those behaviors are reflected. Our goal with this update is to provide defenders the tools they need to detect and mitigate threats in the environments adversaries are targeting today.

While we’ve worked with a number of members of the community pulling this together, we wanted to give a special shout-out to four individuals who shared best practices, security research, and public threat reporting on ESXi with us on the #attacking-Mondays Slack channel. These are Frankie Li and Austin Gadient, Joe Comps, and Nathan Montierth of Vali Cyber. Thank you to these four and everyone who contributed to the ESXi platform!

That’s not all for Enterprise platforms, we’re also introducing a new name, specifically we’ve renamed the Network platform to Network Devices. This name change is meant to more intuitively reflect that the platform comprises techniques used to target network devices such as routers, switches, and load balancers.

As part of our ongoing Enterprise maintenance and updates, we’ve introduced novel behaviors and more technical implementations, including expanded cloud security and Linux coverage, as well as streamlining related techniques by merging overlapping sub-techniques. Some of the updates include:

· T1667: Email Bombing, T1204.004: User Execution: Malicious Copy and Paste and T1668: Exclusive Control demonstrate relatively novel things that threat actors are doing, the first two with a social engineering aspect, and the last focused on how adversaries try to close the door in the face of other intruders.

· T1564.013: Hide Artifacts: Bind Mounts outlines how adversaries with elevated access can use bind mounts to hide malicious processes by overlaying their /proc directory with that of a benign process and mask the identity and activity of the malicious process.

· Nodding to the Democratic People’s Republic of Korea (DPRK) remote work schemes, we added T1219.003: Remote Access Tools: Remote Access Hardware, where adversaries may install legitimate remote access hardware like TinyPilot or PiKVM to create an interactive backdoor that bypasses software defenses and gives them direct control over target systems.

· T1671: Cloud Application Integration highlights how adversaries can abuse OAuth app integrations in Software as a Service (Saas) platforms to persist, bypass Multi-Factor Authentication (MFA), and steal data — even after losing access to the account.

· We also merged T1574.002: Hijack Execution Flow: DLL Side-Loading into T1574.001: Hijack Execution Flow: DLL Search Order Hijacking and renamed it T1574.001: Hijack Execution Flow: DLL to reflect the previously overlapping scope of the two sub-techniques and frequent confusion between them.

Finally, we removed the following optional metadata fields (System Requirements, Permissions Required, Effective Permissions, Supports Remote, and Defense Bypassed) from ATT&CK techniques to streamline content and cut down on redundancy and inconsistent application.

Have thoughts or would like to contribute insights? Share them on Slack or email!

Defense | New Analytics, Optimized Collection, and Elevated Mitigations

This release adds in over 140 analytics, which have been designed to help enhance defender visibility across the intrusion lifecycle, from initial access to lateral movement and exfiltration. As in previous releases, the goal of our analytics is to help defenders more easily implement ways to identify intrusions earlier, track adversary pivots more effectively, and respond faster.

We’ve also upgraded Data Components to go beyond just what to collect. Now, they show you how to optimize your collection with platform-specific guidance, including new support for IaaS and SaaS. You’ll find more targeted recommendations linking components to logs, sensors, and security tools, similar to the approach developed by our Defensive Lead for the Center for Threat Informed Defense’s Sensor Mappings to ATT&CK Project. For example, for the File: File Access data component you’ll find detailed guidance, like tracking file access with Event ID 4663, Sysmon Event ID 11, and specific PowerShell commands for Windows, using auditd and inotify, on Linux, and leveraging offers Unified Logs and FSEvents on macOS, and collecting logs from SMB/CIFS and NAS systems for networked environments.

We’re also continuing our initiative to upgrade and refine Mitigations, and you’ll find many mitigations now feature step-by-step implementation guidance, real-world use cases, and tools that can help with integration into your environment.

To join in on the defensive upgrades, email us or reach out at #defensive_attack.

Mobile | New Software, Techniques, and Mitigation Implementations

We’ve been busy on the Mobile front over the past few months, adding in new techniques and tools that that represent how adversaries are getting more innovative and stealthier. You’ll also find new Mitigation content, with some practical guidance to help developers build more secure software from the start.

After community requests and a surge in real‑world SIM swap activity, we brought back T1451: SIM Card Swap, where attackers hijack phone numbers using stolen personal data to reroute SMS and calls, bypass authentication, and drain funds. We also introduced T1670: Virtualization Solution, spotlighting how malware hides inside legitimate Android apps. On the CTI front, we’ve launched five new tools that snapshot current and emerging threats:

· S1214: Android/SpyAgent for phishing‑driven spyware;

· S1215: Binary Validator and S1216: TriangleDB for Mach‑O reconnaissance and implant chains;

· S1208: FjordPhantom for virtualization‑based banking fraud; and

· S1195: SpyC23 for persistent APT‑style Android compromise.

The Mobile and Enterprise teams also collaborated on S1185: LightSpy, a modular, cross‑platform malware targeting Android, iOS, and macOS. And we introduced C0054: Operation Triangulation, a campaign targeting iOS using zero‑click iMessage exploits to deliver the Binary Validator and TriangleDB implants. Finally, in coordination with the Defensive team, we revised M1013: Application Developer Guidance with specific implementations, use cases, and tools to help developers apply more secure coding throughout the dev lifecycle.

If you have insights, data, or research to share, we would love to collaborate with you! Join us on Slack at #mobile_attack or reach out at attack@mitre.org.

CTI | Diverse Environments, Platform Versatility, & Custom Tools

This release continues our focus on capturing impactful intrusions, from cybercriminal campaigns to state-directed espionage, showcasing how adversaries combine social engineering alongside custom implants, share and reuse infrastructure, and constantly improve their encryption and evasion techniques.

To ATT&CK’s Groups, we’ve added G1045: Salt Typhoon, a People’s Republic of China (PRC) state-backed actor that has targeted network infrastructure at major U.S. telecoms and internet service providers (ISP). We included two other PRC-linked groups, G1042: RedEcho, who reuses S0596: ShadowPad and shares infrastructure with G0096: APT41 to persist in India’s critical sectors, and G1047: Velvet Ant, who exploits zero-days in devices like Cisco Nexus switches to implant custom backdoors and maintain long-term access. We’ve also added the Türkiye-linked G1041: Sea Turtle, which reroutes traffic and spoofs login portals to steal credentials, and Iran’s G1044: APT42, which uses spearphishing and PINEFLOWER Android malware to quietly exfiltrate data. We expanded cybercriminal coverage with G1043: BlackByte and the upgraded 2.0 version of their ransomware that often hits critical infrastructure. We also highlight G1046: Storm-1811, which leverages S1070: Black Basta by spamming inboxes and tricking victims into fake help desk chats that lead to malware deployment.

On the Campaigns side, we added activity related to targeting critical infrastructure and edge devices, obfuscating adversary infrastructure, and exploiting vulnerabilities in artificial intelligence (AI) systems. C0046: ArcaneDoor, C0050: J-magic, and C0048: Operation MidnightEclipse demonstrate how adversaries have exploited networking gear and VPN appliances from Cisco, Juniper, and Palo Alto to stealthily access and try to persist on government and industrial networks. On the Operational Technology (OT) side, the C0041: FrostyGoop incident demonstrates real-world impacts in Ukraine, with heating services disrupted by manipulating control systems. Also in Ukraine, the C0051: APT28 Nearest Neighbor Campaign reflects a physical proximity-based attack, leveraging nearby Wi-Fi networks to infiltrate the intended targets, and highlights that your network perimeter may extend further than you think.

In Australia and Southeast Asia, C0049: Leviathan and C0047: RedDelta used credential theft and lateral movement to quietly extract sensitive data in long-running intrusions, and in espionage campaigns targeting Israeli and Indian organizations, C0044: Juicy Mix and C0042: Outer Space, both linked to G0049: OilRig, relied on tailored malware. With the burgeoning use hybrid infrastructure, we added in C0043: FLORAHOX and C0052: SPACEHOP, that leveraged a mix of compromised routers and leased VPS servers, also known as Operational Relay Box (ORB) networks, to mask traffic and complicate attribution. Finally, the C0045: ShadowRay campaign exploited a flaw in the Ray AI framework, marking one of the first observed exploitation of vulnerabilities in AI infrastructure for access to data and compute resources.

Our adversary-used Software updates and additions this release converge around state-directed and criminal operations that increasingly target diverse environments with platform versatility and feature dual objectives of data theft and destruction/disruption.

• Ransomware + Criminal Innovation: The evolution of BlackByte, LockBit, and Akira into more advanced variants (S1181: BlackByte 2.0, S1202: LockBit 3.0, S1194: Akira_v2) highlights ongoing ransomware-as-a-service (RaaS) maturation. Tools like S1179: Exbyte and S1213: Lumma Stealer show ransomware operators also investing in data theft and exfiltration, monetized via criminal marketplaces and initial access brokers.
• Network Device Targeting: S1203: J-magic, S1206: JumbledPath, S1184: BOLDMOVE, and S1186: Line Dancer focus on edge devices like firewalls and routers, leveraging their blind spots in visibility and patching.
• Wipers/Destructive Operations: Tools like S1167: AcidPour and S1190: Kapeka indicate a continued interest in disruption-focused operations, particularly in Eastern Europe and Ukrainian infrastructure. These tools are often linked to state-linked actors (G0034: Sandworm Team) and tailored for embedded and ICS environments.
• Backdoors & Surveillance: Custom backdoors S1197: GoBear, S1198: Gomir, S1211: Hannotog, S1169: Mango, and S1182: MagicRAT are used for long-term espionage and modular control over compromised networks by state-directed threat groups like G0094: Kimsuky, G0030: Lotus Blossom, G0049: OilRig, and G0032: Lazarus Group.

If you have data or behaviors to share, join us on #attack-cti, or contribute via email.

Software & Infrastructure | More Functionality, Stability & Previews

For developers building their own copies of the website, we’ve upgraded the version of Python required to build it to 3.13. This also goes for the mitreattack-python library, which has been upgraded with additional functionality to work with the ATT&CK v17 STIX content. For ATT&CK Workbench users, we’re changing up our release process using semantic releases, to provide a more stable channel separate from pre-release. This supports the major STIX changes to Data Sources and Data components that will be part of the October release, and we’re giving the community an early look to test and share feedback before the changes go final later this year. Finally, the TAXII 2.1 server has been updated with the ATT&CK v17 content as well.

Questions, suggestions, or moonshot ideas? Let us know on Slack or email.

Up Next | ATT&CKcon CFP, ATT&CKing Mondays & ATT&CK’s 2025 Roadmap

ATT&CKcon

ATT&CKcon will be back for 6.0 on October 14–15, 2025, in McLean, VA, and we’ll continue to focus on how adversaries are adapting and how defenders across the globe are detecting and disrupting them. We’ll be opening our CFP soon, and while we know most submissions will come in right before the deadline (don’t worry, we’ve prepared), we’re looking forward to the innovative ways you’re using ATT&CK. Interested in more information (or interested in sponsoring ATT&CKcon 6.0), visit our conference website at https://na.eventscloud.com/attackcon6.

ATT&CKing Mondays

Every Monday afternoon at 12pm ET we kick off ATT&CKing Mondays, where we explore what works in ATT&CK, and what could be refactored, refined, or reimagined. This is your direct line into helping us advance ATT&CK and to hear different perspectives from across the community. Join the conversations at #attacking-Mondays on ATT&CK’s Slack. Not there yet? Join our community by visiting here.

ATT&CK’s 2025 Roadmap

Stay tuned to this space and ATT&CK’s social media, ATT&CK’s 2025 roadmap is coming soon. We’ll be getting into detail on what to expect in October as we release ATT&CK v18, and some of what we’re considering for this and future years.

Thank you as always to everyone who contributed to this release. We wouldn’t be able to bring you ATT&CK without the active community who shares in-the-wild examples and real-world implementations of what adversaries have been up to. Once again, if you see something, contrib something.

Connect with us on Email, Bluesky, LinkedIn, or Slack.

©2025 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited. 25–01009–1.

ATT&CK v17: New Platform (ESXi), Collection Optimization, & More Countermeasures was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

V16 Brings (Re)Balance: Restructured Cloud, New Analytics, and More Cybercriminals

In v16, we’re all about balance — striking that perfect chord between familiar and pioneering to keep things real and actionable.

This update fine-tunes how we cover cloud environments, finding equilibrium between depth and practicality to ensure it remains practical for defenders. As part of our balancing act, we’re also expanding on familiar threats while introducing some fresh behaviors and groups. This release also features optimized detection engineering offerings and enhanced usability across ATT&CK tools, with the goal of a balanced resource for everyone.

For all the details on our updates/additions across Techniques, Software, Groups and Campaigns take a look at our release notes, our detailed changelog, or our changelog.json.

Enterprise

Cloud Realigned

We’ve been working to fine-tune the balance between abstraction and detail in the Cloud matrix to cover various cloud environments and threats, while staying specific enough to guide actionable defenses. v16 unveils our efforts to keep the matrix practical for defenders across diverse setups, clarify technique descriptions, and ensure that it’s intuitively navigable.

We’d like to introduce the recalibrated Cloud matrix, now featuring four platforms (Iaas, SaaS, Identity Provider, and Office Suite) — key changes include:

• Broadened Identity concept to cover multiple products and services, reflecting how identity functions work similarly across cloud setups.
  – This includes incorporating Azure AD into Identity Provider for clearer cloud functionality distinctions.
• Clarified the Google Workspace and Microsoft 365 overlap with the new Office Suite platform, as they behave nearly identically at the technique level.

Behavior Balancing Act

We maintained our perfect balance formula (Familiar + Novel = Reality) with this release, expanding on existing techniques with behaviors you’ll recognize, but weren’t previously in the matrix — for example, T1557.004: Adversary-in-the-Middle: Evil Twin, T1213.004: Data from Information Repositories: Customer Relationship Management Software and T1213:Data from Information Repositories: Messaging Applications.

For the novelty factor, this release also features some intriguing new behaviors, like T1496.004:Resource Hijacking:Cloud Service Hijacking, where adversaries can hijack compromised SaaS applications (like email and messaging services) to send spam, while also draining your resources and impacting service availability. We also added T1666: Modify Cloud Resource Hierarchy, highlighting how IaaS hierarchies can be manipulated to evade defenses and exploit resources by creating covert subscriptions in Azure or detaching AWS accounts from their organizations.

Our Linux and macOS behavior repository also grew, with the highly demanded T1546.017: Event Triggered Execution: Udev Rules, where adversaries can persist on Linux by tweaking udev rules to run malicious code, exploiting its permissions and background capabilities. The new T1558.005: Steal or Forge Kerberos Tickets: Ccache Files sub reminds us how adversaries can swipe Kerberos tickets from credential cache files to access multiple services as the current user — and even indulge in a little privilege escalation or lateral movement.

For the full list of (sub) technique additions and expansions, check out the changelog!

What’s Next: We’re looking into a optimizing a couple of disparate areas — including restructuring Defense Evasion for clarity and usability. One approach we’re assessing is to organize techniques based on the specific behaviors they represent: those that focus on evading detection and those aimed at circumventing specific mitigations. We’re also evaluating how to refactor metadata to only feature what’s useable and relevant. Have thoughts or would like to contribute insights to either discussion? Share them on Slack or email!

Defensive Coverage

Detection Engineering

Our Defensive goal for this year was to expand detections and mitigations, and help you get more actionable through detection engineering. With our optimization of our pseudocode format for analytics — reflecting real-world query language that is meant to serve as a template for your tailored queries — v16 is coming in hot with a whole host of new analytic blueprints.

In the Execution, we’ve added 85 new analytics, to help you identify techniques that execute malicious code,120 new analytics under Credential Access aimed at capturing the behaviors used to steal credentials, and 26 new Cloud analytics designed to highlight techniques that exploit Microsoft 365 & Azure AD.

As a bonus, v16 also features a STIX analytic extraction Python script that lets you quickly pull and export analytics.

Mitigations

On the Mitigations front, we added a new mitigation: Out of Band Communication, focused on secure, alternative communication channels — like encrypted messaging or satellite lines — to keep critical comms safe and running during incidents and bypassing any compromised network systems. We also enhanced Active Directory Configuration with a community contribution that adds clearer examples and detailed interpretations of group policy settings. As we continue to update Mitigations, we need your insights! When you share specific use cases, clearer examples, and detailed configurations, you’re making it easier for fellow defenders to understand and implement mitigations effectively.

What’s Next: We have a lot on our docket and some areas we’re still considering, including implementing STIX IDs for data components to improve clarity and tracking, developing analytics for Initial Access and Exfiltration, and Discovery, and revamping our data sources for actionability. We’ll also be looking into multi-event analytics that examine how different sources, like file modifications and process creation, interact within a short time frame instead of focusing on just one collection source. We would love your insights and collaboration on these initiatives — email or join #defensive_attack to get involved!

Cyber Threat Intelligence

Our CTI updates also embody the perfect balance formula: we’re working to close the representation gaps in the cybercrime space while continuing to update state-attributed groups.

Some of the cybercriminal additions in v16 include G1032 (Inc Ransom), a group notorious for its double-extortion tactics, as well as the G1040 (Play) ransomware group, that utilizes advanced encryption and targeting of high-value victims. Both groups exploit known vulnerabilities to gain initial access and steal data before deploying their ransomware. Additionally, G1037 operates as an initial access broker, using phishing techniques to infiltrate networks.

On the State front, we updated G0007 and G0034, both linked to different units of Russia’s General Staff Main Intelligence Directorate (GRU), with common behaviors, such as using malicious Microsoft Office attachments in their spear-phishing emails.

What’s Next: Moving forward, we intend to continue staying responsive to your contributions — highlighting groups, software, and campaigns that matter to practitioners, while also showcasing unique and exceptional tradecraft to highlight techniques. Got brilliant insights or behaviors to share? Join us on #attack-cti, or contribute.

Software Development

Our Software goal this year was to enhance usability and streamline processes for ATT&CK tools and infrastructure. We’ve been working hard towards these goals, but most importantly, we introduced our new TAXII server: the MITRE ATT&CK Workbench TAXII 2.1 Server and open-sourced the TAXII 2.1 code to enable you to establish your own servers within your organization and contribute to enhancing it. As you’re exploring the new 2.1 server, remember that we’ll be retiring the TAXII 2.0 server on December 18. To continue receiving updated ATT&CK data, you’ll need to migrate from cti-taxii.mitre.org to attack-taxii.mitre.org. Check out our TAXII 2.1 blog post for more details.

What’s Next: We’re planning on rolling out ATT&CK Data Model 1.0, which will introduce Platform objects and assign ATT&CK IDs to data components for easier tracking. We’ll also be updating the defensive objects structure for intuitiveness and simplifying the Workbench process. On the website front, our goal is to move towards a modern framework and ensure consistency and clarity across ATT&CK tools and documentation with STIX 2.1.

You Bring the Insights, We’ll Bring the Updates

We deeply value our community, and your in-the-wild examples and real-world implementations are what ensure that ATT&CK remains relevant and actionable, so if you see something, contrib something.

Looking ahead, we can’t wait to keep partnering with you on everything we have lined up — as well as all the things we haven’t planned yet but will absolutely end up on our agenda, thanks to your great contributions.

Connect with us on Email, Twitter, LinkedIn, or Slack.

©2024 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 24–00779–4.

v16 Cloud Rebalancing, Analytics, was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

As mentioned in our 2024 Roadmap and the v15 release blog, we’re excited to introduce our new TAXII server and the latest addition to the ATT&CK Workbench software suite: the MITRE ATT&CK Workbench TAXII 2.1 Server. We’ve open-sourced the TAXII 2.1 code on GitHub, allowing you to set up your own servers within your organization and contribute to its improvement.

While you’re diving into the new 2.1 server, don’t forget: our TAXII 2.0 server is retiring on December 18.

To continue receiving updated ATT&CK data, you’ll need to migrate from cti-taxii.mitre.org to attack-taxii.mitre.org. However, this migration may involve more than just a URL change. Given the transition from STIX 2.0 to STIX 2.1, the complexity of your migration will depend on how deeply your applications are integrated with STIX 2.0. We recommend assessing the impact on your systems and planning your migration accordingly.

Getting Started with TAXII 2.1

Ready to explore the MITRE ATT&CK Workbench TAXII 2.1 server?

• Visit our GitHub repository for the source code and detailed usage documentation.
• Leverage the ATT&CK Workbench Deployment repository with Docker Compose templates to simplify setting up Workbench services and the TAXII 2.1 module (so you can pull the Docker images from GitHub and get started without building from source!).
• Skip the source code and pull the TAXII 2.1 Docker image directly from the GitHub Container Registry.
• Access the server Swagger interface and Bruno API Client definitions (Bruno, similar to Postman, provides an easy way to interact with REST APIs). You can find our Bruno files here.
• Familiarize yourself with the OASIS TAXII 2.1 specification to enhance your integration prowess.
• Experience issues? Submit specific requests or encounter issues on GitHub.

Why TAXII 2.1?

We know the ATT&CK community has relied on our public TAXII 2.0 server, but it had issues like frequent outages. The TAXII 2.1 server addresses these problems with a more reliable and smooth experience. It’s built for scalability and stress-tested with real-world benchmarks from TAXII 2.0, ensuring you’re less likely to face major outages. Additionally, the new server introduces pagination, which was missing in TAXII 2.0. This means you can fetch smaller chunks of data instead of the entire ~20 MB STIX collection, speeding up the process and reducing data transfer costs.

A critical update to note is that our TAXII 2.1 server will exclusively host STIX 2.1 content moving forward. This change is part of our long-term strategy to shift away from STIX 2.0, aligning with the latest standards.

The new TAXII 2.1 server is also more powerful and capable than the previous version. We designed it to smoothly integrate with Workbench, making CTI management as seamless as possible. If you’re already using the ATT&CK Workbench in your CTI workflows, you can easily edit and maintain CTI data without needing additional tools. The TAXII 2.1 server integrates with the ATT&CK Workbench software suite, and can automatically synch with the Workbench REST API (the Workbench “back end”).

Workbench users can add objects, STIX collections, and bundles, and the TAXII 2.1 server will automatically make them available via its REST API. You don’t need to change your editor workflows — just bring the TAXII 2.1 server online in your Workbench container stack, and it will sync every 30 minutes by default (administrators can adjust this if needed). TAXII 2.1 is also optional, and you can continue using Workbench as usual without it.

Of note, the TAXII 2.1 specification outlines two “sharing models” for TAXII server implementations:

• The Collection model, where the TAXII server allows producers to host a set of CTI data that can be requested by consumers: TAXII Clients and Servers exchange information in a request-response model.
• The Channel model, where the TAXII server uses the publish-subscribe pattern to allow producers to push data to many consumers and consumers to receive data from many producers.

Given that Channels are still loosely defined in the TAXII specification, we decided to only implement the Collections model outlined in the TAXII 2.1 specification. However, we are open to adding support for a pub-sub model in future releases.

A Brief Guide to Accessing Threat Intelligence Data

With the new TAXII 2.1 server, you can still access your cyber threat intel in STIX format through the publicly accessible REST API, just like its predecessor (cti-taxii.mitre.org) that’s been around for over 6 years. Even though this server has some sophisticated functionality, querying it is actually pretty simple. This following guide will show you the basics and help you easily get the threat intelligence data you need.

With TAXII 2.1 running on a RESTful API model and using standard HTTP requests, you can connect to the server using any HTTP client you like. This includes popular tools like curl, wget, httpie, or Postman. This flexibility allows you to seamlessly integrate TAXII 2.1 queries into your existing workflows and tools.

Let’s dive into how to structure these requests and interpret the responses.

Importantly, all TAXII 2.1 requests require a special Accept header:

GET /taxii2/ HTTP/1.1 Accept: application/taxii+json;version=2.1 Host: attack-taxii.mitre.org

Here is an example of setting the Accept header using the curl tool:

curl --request GET \
  --url https://attack-taxii.mitre.org/taxii2/ \
  --header ‘Accept: application/taxii+json;version=2.1’

The request above sends a request to the TAXII server’s Discovery endpoint, which returns a list of available API roots that the TAXII server offers. Each API Root is the “root” URL of that particular instance of the TAXII API. Our TAXII server only hosts one API Root, which we can see clearly from the response body:

{ 
  "title": "MITRE ATT&CK TAXII 2.1", 
  "description": "This API Root contains TAXII 2.1 REST API endpoints that serve MITRE ATT&CK STIX 2.1 data", 
  "default": "api/v21", 
  "api_roots": [ 
    "api/v21" 
  ] 
} 

Great! Now that we have the API Root, let’s see if we can query for a list of available TAXII Collections:

curl --request GET \  
    --url https://attack-taxii.mitre.org/api/v21/collections/ \  
    --header 'Accept: application/taxii+json;version=2.1' 

The response should look something like the following:

{
  “collections”: [
    {
      “id”: “x-mitre-collection — 1f5f1533-f617–4ca8–9ab4–6a02367fa019”,
      “title”: “Enterprise ATT&CK”,
      “description”: “ATT&CK for Enterprise provides a knowledge base of real-world adversary behavior targeting traditional enterprise networks. ATT&CK for Enterprise covers the following platforms: Windows, macOS, Linux, PRE, Office 365, Google Workspace, IaaS, Network, and Containers.”,
      “canRead”: true,
      “canWrite”: false,
      “mediaTypes”: [
        “application/taxii+json;version=2.1”,
        “application/taxii+json”
      ]
    },
    {
      id”: “x-mitre-collection — 90c00720–636b-4485-b342–8751d232bf09”,
      “title”: “ICS ATT&CK”,
      …
    },
    {
      “id”: “x-mitre-collection — dac0d2d7–8653–445c-9bff-82f934c1e858”,
      “title”: “Mobile ATT&CK”,
      …
    }
  ]
}

The response lists three objects that match the main ATT&CK domains: Enterprise, Mobile, and ICS. Of note, TAXII Collections and STIX Collections are different concepts — with TAXII Collections operating as versatile containers for CTI objects. For our MITRE ATT&CK TAXII server, we’ve mapped each TAXII Collection directly to an ATT&CK domain. This means querying a TAXII Collection from our server provides data from just one domain, simplifying the user experience and aligning with the ATT&CK framework. While this mapping isn’t required by the TAXII protocol and other servers may organize collections differently, we chose this method to make our server more intuitive for the ATT&CK community.

Now that we have our API Root and the available TAXII Collections, we’re ready to retrieve some CTI objects:

curl --request GET \
  --url 'https://attack-taxii.mitre.org/api/v21/collections/x-mitre-collection--dac0d2d7-8653-445c-9bff-82f934c1e858/objects?limit=100' \
  --header ‘Accept: application/taxii+json;version=2.1’

This request sends a request for the first 100 objects from the Enterprise ATT&CK collection. The response should look something like this:

{
  “more”: true,
  “next”: “1”,
  “objects”: [←100 →]
}

If the ‘more’ property is set to true and the ‘next’ property is populated, then the client can paginate through the remaining records using the ‘next’ URL parameter along with the same original query options. So, we can request the second page of 100 objects by simply adding the ‘next=1’ query parameter to the original request:

curl --request GET \  
    --url 'https://attack-taxii.mitre.org/api/v21/collections/x-mitre-collection--dac0d2d7-8653-445c-9bff-82f934c1e858/objects?limit=100&next=1' \  
    --header 'Accept: application/taxii+json;version=2.1' 

What’s Next for ATT&CK Workbench TAXII 2.1

We believe the release of the MITRE ATT&CK Workbench TAXII 2.1 server is a big step forward for threat intelligence sharing — and we have even more exciting integrations on our roadmap to make the TAXII experience even smoother:

• Workbench UI indicators that signal whether an object or collection is actively being shared through TAXII;
• Workbench UI toggles that allow users to pause (or enable) the sharing objects and collections with TAXII;
• Workbench role-based access controls (RBAC) for TAXII administration.

Stay tuned for more updates and enhancements as we continue to evolve our tools!

©2024 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 24–00195–2.

Introducing TAXII 2.1 and a fond farewell to the TAXII 2.0 Server was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

v15 is all about actionability and bringing defenders’ reality into focus — we prioritized what you need to detect, and how you can do it more effectively with detection engineering upgrades, and deeper intelligence insights across platforms. This release also reflects the new expansion rhythm, balancing both well-known and emerging behaviors to reflect how trends and activity are experienced in the field.

For the details on our updates/additions across Techniques, Software, Groups and Campaigns take a look at our release notes, our detailed changelog, or our changelog.json.

Enterprise | Familiar + Novel = Reality

With v15 we were aiming for the perfect balance of familiar behaviors you’ve probably seen countless times (e.g., T1027.013: Obfuscated Files or Information: Encrypted/ Encoded File, T1665: Hide Infrastructure), as well as newer, emerging trends. The shadowy domain of Resource Development was expanded to illuminate how adversaries are using generative artificial intelligence tools, like large language models (LLMs), to support various malicious activities (T1588.007: Obtain Capabilities: Artificial Intelligence). And it’s not just about gaining initial access anymore — we added T1584.008: Compromise Infrastructure: Network Devices to capture how threat groups are hacking into third-party network devices, including small office/home office routers, to use these devices to facilitate further targeting.

Cloud | More Actionability

As outlined in the ATT&CK 2024 Roadmap, we’re striving to make the Cloud matrix more approachable for defenders of all skill levels. With this release, we focused on providing a broader set of defensive measures, resources, and insights for CI/CD pipelines, Infrastructure as Code (IaC), and Identity. v15 features new mitigations and data sources on token protection, along with more specific references to Okta logs. T1072: Software Deployment Tools was expanded to include broad execution of T1651: Cloud Administration Command, reflecting how threat actors are turning cloud native tools like AWS Systems Manager into remote access trojans.

We ramped up resources for CI/CD pipelines and IaC, and made some refinements to Identity, with the expansion of T1484: Domain Policy Modification to include not just Azure AD, but also other identity-as-a-service providers like Okta. T1556: Modify Authentication Process gained a new sub (T1556.009: Conditional Access Policies) exploring how threat actors have tampered with or disabled conditional access policies for ongoing access to compromised accounts. We also expanded T1136.003: Create Account: Cloud Account with additional service account insights.

What’s Next: v16 will feature robust identity and detection updates, as well as the platform rebalancing operations, where we’re focusing on covering a wider range of cloud environments and threats, while making it more intuitive to prioritize techniques relevant to a specific platform.

Defensive Coverage | Upgrading, Converting & Restructuring Defensive Measures

You’ll find expanded detections in v15 to assist your detection engineering. Previously, we structured our analytics in a pseudo format that was consistent with the Cyber Analytic Repository (CAR). In some cases this was hard to understand.

In v15, we transformed that format into a real-world query language style (like Splunk) that is compatible with various security tools. These upgrades are featured in detections across the framework including some techniques within the Execution tactic.

Our aim with these upgrades, is to reflect the data source itself is the data you should be collecting, and to provide an understandable format that pairs well with every day defender tools (i.e. SIEMs and Sensors).

We have also synced up some mitigations within the parent to sub-technique relationship. Our team has analyzed a list of sub-techniques that had mitigations that the parent technique did not have. In v15, you will find some parent techniques now reflect what mitigations are seen in the sub-technique.

What’s Next: As we gear up for October, we’ll be completing the Execution detections, refining Credential Access detections, diving into Cloud analytics, and restructuring our data sources for better accessibility.

ICS | Cross-Domain Campaigns

We’ve been working to retrofit major incidents in the ICS space to improve understanding and showcase how ICS and enterprise techniques intersect in each event. V15 illuminates some of the ICS-Enterprise integration efforts, with the release of four cross-mapped campaigns:

· Starting with Triton, the Safety Instrumented System attack of 2017 that shook the petrochemical industry to its core.

· Then there’s C0032, a campaign spanning various utilities from 2014 to 2017, often grouped with the petrochemical incident but distinctly different in nature.

· Next up, Unitronics, a spree that zeroed-in on specific devices and impacted utilities and organizations worldwide. This campaign saw adversaries disrupting device interfaces to make them unusable for end users.

· Fast forward to 2022 Ukraine Electric Power, where we witnessed a glimpse into the future of ICS attacks, with hypervisor features and shared domain access exploited to infiltrate ICS systems and unleash havoc. The campaign highlights key considerations regarding hypervisor usage across multiple domains, and the abuse of native features in vendor software.

2022 Ukraine also spawned two new ICS techniques that are featured in this release: T0895: Autorun Image and T0894:System Binary Proxy Execution via vendor application binaries.

What’s Next: v16 will launch ICS sub-techniques, along with a structured cross-walk to enable mapping between deprecated and new techniques. We’ll also be releasing new asset coverage and updates on our exploration into incorporating more sectors into the ICS matrix.

Mobile | New Techniques, Software, Groups & Mitigations

With help from our community, this release incorporates new techniques, including — exploiting software vulnerabilities for initial access and adversaries performing active and automated discovery for the lowdown on your network setup — and incorporated fresh software and groups. We also added a new mitigation to the Mobile matrix, M1059 Do Not Mitigate (for Mobile) as a sneak peek to the new mitigations that will be added in future releases. This release also features the first Mobile campaign, C0033, associated with PROMETHIUM (G0056). The group primarily targets Windows devices, however, recent reporting and external contributions demonstrated a shift to mobile exploitation on Android and iOS devices.

We added in Mobile techniques to existing Groups and Software to illuminate the shift to include mobile exploitation. This includes building out the APT-C-23 (G1028) profile, mirroring this South American threat group’s targeting of Android and iOS devices, and recording how BITTER (G1002) has distributed malicious apps via SMS, WhatsApp, and various social media platforms.

What’s Next: In the coming months, we’ll be rolling out more structured detections, and boosting proactivity across Mobile by evaluating incorporation of pre-intrusion techniques, like active and passive reconnaissance, and acquiring or developing resources for targeting.

Cyber Threat Intelligence | More Cybercriminal, Underrepresented Groups

We’re working towards better reflecting the threat landscape by infusing the framework with more cybercriminal and underreported adversary activity. This release showcases new cybercriminal operations and highlights Malteiro, a criminal group believed to be based in Brazil. They are known for operating and distributing the Mispadu/URSA banking trojan through a malware-as-a-service model. Banking trojans, a notorious threat in Latin America, are increasingly spreading their chaos across borders, courtesy of malware developers selling tools to overseas operators. Malteiro’s operations exemplify this targeting shift, evident in a recent campaign affecting European entities across various sectors.

What’s Next: We’ll continue conducting thorough assessments of Groups, Software, and Campaigns to up the framework realism quotient and provide clearer insights into adversary activities. We’re also teaming up with ATT&CK domain leads to expand coverage of cross-domain intrusions.

Software Dev | TAXII 2.1, FTW

We’ve been working towards our goals of enhancing Navigator’s usability and streamlining processes for ATT&CK Workbench. Most importantly, we’re taking our TAXII server to new heights, and by December 18, we’ll be retiring the TAXII 2.0 server and transitioning to the upgraded TAXII 2.1 version. You can locate the documentation for the TAXII 2.1 server in our GitHub repository.

What’s Next: We’ll be continuing to enhance usability on ATT&CK Workbench and Navigator, and building towards swifter Groups and Software releases. Mark your calendars to update the URLs for TAXII 2.1 clients to connect to https://attack-taxii.mitre.org instead of https://cti-taxii.mitre.org!

In Conclusion | Field Reports, Benefactors

We’re always on the lookout for field reports and insights from those of you on the ground. Your observations play a crucial role in improving ATT&CK’s tactical utility — so remember, if you see something, contrib something. Curious about how a contribution becomes a technique? Check out our video that walks you through the process.

If you’re interested in contributing to ATT&CK’s overall autonomy, flexibility, and free services, you can find more details on our Benefactor page. We are deeply grateful to our initial cohort of benefactors, SOC Prime, Tidal Cyber, and Zimperium, for their generous support.

©2024 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 24–00779–3.

ATT&CK v15 Brings the Action was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.

Enhancing usability, expanding scope, optimizing defenses

2023 was dynamic year for ATT&CK. We marked a decade of progress since the framework’s inception and achieved some key milestones to make ATT&CK more accessible for a wider community. Our scope (slightly) expanded to encompass activities adjacent to direct Enterprise interactions, such as non-technical, deceptive practices and social engineering techniques (Financial Theft, Impersonation, and Spearphishing Voice). We enhanced detection capabilities with integrated notes, pseudocode from CAR, and BZAR-based analytics. The ICS matrix welcomed the addition of Assets to enhance inter-sector communication and mapping. We rolled out Mobile-specific data sources, structured detections, and behaviors like smishing, quishing, and vishing. Website navigation was improved, along with a faster Search bar, and updates that hit you faster than you can say “resources/changelog.html”. We also maintained a steady cadence of updates and new content from the ATT&CK team and external contributors.

In October, we successfully held ATT&CKcon 4.0, with new insights shared and realistic applications demonstrated by practitioners. And finally, we kickstarted the ATT&CK Benefactor program.

2024 Roadmap: Vision & Goals

Since launching ATT&CK, we’ve been humbled to witness how the community has integrated it across widely varied spheres and around the globe. The vision for ATT&CK has always been to enable the broadest use across the widest spectrum of stakeholders — whether you’re cross-mapping between domains, annotating and developing tailored Navigator layers, or using the framework as a blueprint to build multi-platform threat models. ATT&CK was designed to empower defenders precisely where they need it most. This is the core thesis for ATT&CK, and as its stewards, we’ll continue prioritizing measures that advance a more inclusive, relevant, and actionable framework.

In line with this vision, our 2024 goals are to bolster broader usability and enhance actionable defensive measures for practitioners across every domain. This includes exploring scope adjustments and platform rebalancing, as well as implementing structural modifications with the introduction of ICS sub-techniques. A core focus will be reinforcing defensive mechanisms and optimizing their user-friendliness. We’ll be bridging Linux and macOS information gaps and enhancing prominent adversary representation. The ATT&CK Navigator, Workbench, and website will feature reengineering to improve accessibility and enable swifter ATT&CK Group/Software/Campaign updates. We’ll also be sunsetting the TAXII 2.0 server by December 18 in favor of the upgraded TAXII 2.1 version. Finally, we’ll continue amplifying the key driver behind ATT&CK — community collaboration. This includes hosting ATT&CKcon 5.0 in October, and maintaining support for the European Union (EU) and Asia-Pacific (APAC) ATT&CK Community Workshops.

Enterprise | Integrated Defense

In tune with ATT&CK’s vision, we’re continuously re-evaluating Enterprise’s scope to more accurately reflect the threats faced by real defenders. Matrices and platforms are conceptual schematics, not real-world structures, and we’re assessing realignments, expansions, and refinements of platforms to represent interconnected organizations, the adversaries they encounter, and the reality of defenders. Our goal is to advance a cohesive and integrated framework that provides more functional use cases and empowers users to visualize and create adaptable defenses against cross-platform threats.

Cloud | Matrix Balance & More Actionability

Our Cloud goal this year is to enable defenders (both new and seasoned) to better leverage the Cloud matrix for defensive action. This includes focusing on emerging and significant threats to the domain, upgrading Cloud analytics, and optimizing the balance between generalization and detail in the matrix.

With a considerable portion of cloud identities retaining super admin access, and the frequency of identity-related intrusions across the domain, we’ve been reinforcing and creating more detailed techniques for identity-based attacks. We’ll also be diving into the exploitation of Continuous Integration/Continuous Deployment (CI/CD) pipelines and the malicious use of Infrastructure as Code (IaC). Our Cloud analytics effort will elevate your actionability, by outlining the steps to detect specific behaviors, and providing additional context on what to find and collect.

We’ll also be evaluating how to best refine the balance between abstraction and specificity in the matrix. Our exploration will assess if the platforms are broad enough to cover a wide range of cloud environments and threats, yet specific enough to inform defensive actions. This balance is crucial for the matrix to remain practical and useful for defenders operating in diverse cloud environments. Our aim is to make navigating the Cloud matrix more intuitive and enable users to prioritize techniques relevant to their specific platform.

Ready to navigate the Cloud with us? Sail over to #cloud_attack.

macOS/Linux | Countermeasures for Priv Esc and Defense Evasion

Our goal for Linux and macOS is to equip practitioners with more robust countermeasures and help bridge the information gap on defending these systems. We’ll continue tracking down in-the-wild adversary behaviors and building more macOS and Linux-only (sub)techniques to optimize defensive arsenals. For Linux we’ll be exploring privilege escalation and defense evasion to better align with in-the-wild adversary activity. On the macOS side, we’ll be strategically bolstering the platform, with a particular emphasis on threats associated with elevated permissions.

If you have intelligence or technique ideas, we would love to collaborate. We rely on the practitioners who work with these systems day-in and day-out to help us identify gaps and provide invaluable insights. Ready to contribute? email us and join our #linux_attack or #macos_attack slack channel.

Defensive Coverage | Upgrading, Converting & Restructuring Defensive Measures

Our Defensive goal this year is to expand detections and mitigations to help you better optimize your detection engineering — and maybe get a little more actionable. The April release will include both new and updated mitigations that incorporate best practices from contributors, and industry standards meticulously mapped by our defense team.

Over the past few months, we’ve also been examining analytic language approaches. Our aim? Transforming detection logic into formats compatible with different security tools, including more consistent with real-world query languages such as Splunk . This will simplify the process of aligning your SIEM data with ATT&CK detections, making it easier to understand. We’re also incorporating data collection sources for a given detection query. For example, pulling information from Windows Event logs or Sysmon and the associated Event Code. The new analytic style in ATT&CK will overhal the previously used CAR-like pseudocode, and will be the model for future analytics. This will enhance compatibility across various environments and help you hunt threats more efficiently.

Lately, we’ve been prioritizing improving detections under the Execution tactic, where some of the most employed techniques fall. v15 will showcase a subset of these enhanced detections, featuring the trifecta of CAR (Cyber Analytics Repository) pseudocode, BZAR-based analytics (Bro/Zeek ATT&CK-based Analytics and Reporting) and detection notes.

Gearing up for October, we’ll be completing the enhanced detections for Execution, sculpting out Credential Access detections, exploring the universe of Cloud analytics, and navigating how to restructure our data sources for improved accessibility. This means sprucing up data source definitions and matching them to everyday use cases like sensor mappings. This way, you can more easily identify the tools and events that clue you in on shady activity. Additionally, you can opt for the data sources that best align with your specific needs. The revamp will also include the introduction of STIX IDs for data components, making it more intuitive to reference and integrate data sources.

Join our ranks at #defensive_attack channel.

ICS | Subs, Asset Expansion, & Cross-Domain Integration

ICS is leveling up this year. Our goals include broadening ICS horizons with new asset coverage, exploring platform scope expansion, and continuing our multi-domain integration quest. We’ll also be diving deeper into adversary behaviors with the introduction of sub-techniques. v15 will showcase some of integration efforts, with the release of cross-mapped campaigns. These campaigns track IT to OT attack sequences, helping defenders better understand multi-domain intrusions and informing unified defense strategies across technology environments.

The October release will feature a structural shake-up, with the first tranche of the long-awaited sub-techniques. Like Enterprise and Mobile sub-techniques, ICS subs will break down techniques into more detail. This increased granularity allows defenders to understand the nuances of adversaries’ execution of a given technique, enhancing their ability to detect and mitigate them. The technique restructuring will involve modifying the name and scope of techniques and integrating them more effectively with other domains. This integration will foster a more comprehensive defensive approach on both the right and left of launch. You can expect a subs crosswalk to help you understand our decisions and how things map between deprecated and new techniques.

October will also include some additional treats with Asset coverage expansion, building upon the Asset refactoring in v14. The refactoring strived to provide a clearer picture of the devices, systems, or platforms a specific technique could target and introduced the concept of Related Assets. Related Assets links cross-sector Assets that share similar functions, capabilities, and architectural locations/properties, highlighting that they may also be susceptible to the same techniques. v16 will feature additional Related Assets, as well as more in-depth definitions and refined mappings of technique relationships for different devices and systems. You can start leveraging Assets for your defensive activities by viewing the technique mappings from Asset pages, or by reviewing Asset mappings from a technique page. We’ll also be scouting how to incorporate additional sectors such as such as maritime, rail, and electric.

We welcome input from all sectors on how to improve identification of key assets and any additional adversary behaviors you have observed in the wild. Reach out to us at attack@mitre.org or #ics_attack

Mobile | Detections & Mitigations Optimization + PRE Exploration

Mobile’s goal is to dial up the pre-and-post-compromise defensive measures this year, with a detections and mitigations upgrade and an exploratory mission into pre-intrusion behaviors for the matrix. We introduced Mobile structured detections in v14 and will continue building out structured detections as well as expanding our mitigations across the matrix. For optimal actionability, we’ll be leveraging the best practices and tangible experiences from the mobile security community.

In the coming months we’ll also be evaluating how to enhance inter-domain connectivity across platforms and exploring integrating proactive tactics into the Mobile matrix. Our goal is to better reflect evolving adversary activity targeting the domain. This research quest will examine adversary actions before attacks, like active and passive Reconnaissance, and acquiring or developing resources for targeting purposes.

Collaboration and knowledge-sharing with the community will to be a driver for Mobile’s development in 2024. In addition to ramping up detections and mitigations, we’re particularly interested in partnering with mobile defenders to examine potential areas where communications platforms or domains could be added into ATT&CK. If you’re interested, connect via attack@mitre.org or join #mobile_attack.

Software Development | Enhanced Usability & Streamlined Workflows

Our Software goals this year are to increase usability across ATT&CK Workbench and Navigator, and streamline Groups and Software releases. Adversaries evolve quickly, so we’re optimizing Workbench workflows to harmonize Group and Software releases more closely to their cadence. This includes developing enhanced search capabilities, improving ATT&CK object-collection association, and overhauling the Collection Manager UI for the ATT&CK Workbench. These renovations will fine-tune the approval of ATT&CK object changes and the matching of collection bundle differences with official ATT&CK changelog types, resulting in swifter releases.

For ATT&CK Navigator, we’re refining the user experience, and the experience of anyone reading your reports. We’ll be upgrading SVG export function for sleeker output designs, providing smoother navigation with intuitive export controls, and rolling out an in-website tutorial for mastery of all the key features. We’ll also be updating the official content source to the STIX 2.1 repository — making everything a little more robust and flexible.

Finally, we’re taking our TAXII server to the next level! We’ll be sunsetting the TAXII 2.0 server by December 18, as we transition to the upgraded TAXII 2.1 version. You can access the documentation for TAXII 2.1 server in our GitHub repository. Remember to switch URLs for TAXII 2.1 clients to connect to https://attack-taxii.mitre.org instead of https://cti-taxii.mitre.org. And get ready to experience enhanced features and smoother operations.

Cyber Threat Intelligence | More Cybercriminal, Underrepresented Groups

With CTI, our mission is to better reflect the reality of the threat landscape by infusing more cybercriminal and underreported adversary activity into the framework. By bridging gaps in representation and minimizing those unknowns, we aim to provide defenders with better insights and tools to counter a wider array of threats. A pivotal aspect of this effort includes gap assessments of Groups, Software, and Campaigns. These evaluations will help us pinpoint any disparities between the current content and the reality of adversary activities.

Our releases this year will feature more cybercriminal operations and under-monitored regions, including Latin America, offering a more nuanced understanding of global threats. We’re also collaborating with ATT&CK domain leads to expand coverage of cross-domain intrusions to inform a more unified approach to undermining adversaries.

To join this quest, engage at attack@mitre.org

Community Collaboration

ATT&CK Community Workshops | Practitioner-led Forums for Activating ATT&CK

We’re always inspired to see how ATT&CK is being used in innovative ways to upgrade defensive capabilities. The regional ATT&CK community workshops — organized by practitioners, for practitioners — provide forums to share insights, use cases, and collaborative approaches for leveraging ATT&CK.

• The European Union (EU) ATT&CK Community workshop, hosted by the Centre for Cybersecurity Belgium and supported by the Center for Threat-Informed Defense (CTID) was the first regional ATT&CK workshop, The 2024 iteration will take place in Brussels, Belgium on May 17, in-person and virtually.
• The Asia-Pacific (APAC) ATT&CK Community Workshop, hosted by the by the CTID, launches this April 25–26 in Singapore, and virtual attendance is still open. The Workshop will advance threat-informed defense through hands-on training, ATT&CK best practices, worst practices, and moonshot approaches.

ATT&CKcon 5.0 | Great Speakers, Content, & Conversations around ATT&CK

ATT&CKcon 5.0 will be arriving October 22–23, featuring both virtual and in-person attendance from McLean, VA. Stay tuned to our Twitter and LinkedIn channels for updates on our Call for Presentations, which will open in the coming months, followed by our illustrious speaker lineup. If your organization is thinking about joining the ATT&CKcon adventure as a sponsor, please reach out to us at attackcon@mitre.org.

Benefactor Program | Empowering Defenders, Sustaining Independence

We want to take a moment to share some insights into the foundational tenants and financial realities of ATT&CK. Much like we crowd-source intelligence and rely on community contributions, ATT&CK itself was built to be independent, responsive, and part of the global community.

From the outset, we deliberately chose not to align ATT&CK with any specific government department or agency. This decision was made to maintain autonomy, flexibility, and to foster collaboration across the broadest spectrum of stakeholders. While this approach has facilitated agility and international partnerships, it also means that ATT&CK lacks a dedicated funding source.

To bridge this funding gap and ensure the continuity of our operations, as well as expanding into new domains, we launched the Benefactor Program last year. This program enables tax-deductible, charitable donations from individuals and organizations who believe in ATT&CK’s mission. These contributions allow us to continue offering free and accessible services while also advancing our capabilities and scope.

We are immensely grateful for the support we have received thus far from initial benefactors SOC Prime, Tidal Cyber, and Zimperium. We remain committed to serving the community with transparency; whether you’re a contributor, a fellow defender, or just getting started, we thank you for being part of ATT&CK’s journey.

Looking Forward

Mark your calendars for the v15 release on April 23! You’ll see some novel content interspersed with familiar elements, as well as more practical defensive measures.

As always, we value the opportunity to collaborate with you in ensuring that ATT&CK remains a living framework, where each contribution, conversation, or new implementation fuels its evolution. We look forward to continuing this adventure with you.

Connect with us on email, Twitter, LinkedIn, or Slack.

©2024 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 24–00779–2.

ATT&CK 2024 Roadmap was originally published in MITRE ATT&CK® on Medium, where people are continuing the conversation by highlighting and responding to this story.