MITRE ATT&CK v20 adds AI abuse and water attacks

MITRE released ATT&CK v20 (13 October 2026), introducing nine new Enterprise techniques including five AI-focused entries, multiple ICS detection and execution updates, and two documented campaigns: C0066 (2026 U.S. water utilities attacks impacting 30+ municipal utilities via internet-exposed Rockwell/Allen‑Bradlely controllers accessed through cellular gateways, with at least one plant taken offline) and C0064 (an AI-assisted breach affecting Mexican government infrastructure and a municipal water utility). The release adds new detection strategies for Enterprise and ICS, updates supply-chain and MFA-related techniques, and includes new group profiles (NIMBUS MANTICORE, The Gentlemen), with immediate implications for defenders who must update ATT&CK coverage mappings and review controls for AI agents, exposed OT controllers, and application-specific passwords.