MITRE has released ATT&CK v20, and this one changes how ICS mappings are written. If your detections, threat models or compliance crosswalks point at ATT&CK for ICS, some of those references are now out of date.
What changed in ATT&CK for ICS:
• New technique T1701 Command and Scripting Interpreter, with six sub-techniques: .001 PowerShell, .002 Windows Command Shell, .003 Unix Shell, .004 Visual Basic, .005 Python and .006 JavaScript. It replaces T0807 Command-Line Interface and T0853 Scripting, which are both deprecated.
• Two new sub-techniques under T0869 Standard Application Layer Protocol: T0869.001 DNS and T0869.002 Publish/Subscribe Protocols. These cover command and control hidden in protocols industrial networks already use. MITRE also added mitigation M1061 Limit Software/Package Installation.
• Two new campaigns. C0066 2026 U.S. Water Utilities Attacks (not formally attributed) reached internet-facing PLCs across more than 30 Minnesota water and wastewater utilities and locked operators out of their own systems. C0064 AI-Assisted Breach of Mexico's Government Infrastructure crossed IT and OT and reached a municipal water utility.
• New software: S9046 IOControl, CyberAv3ngers (G1027) malware for Linux-based IoT and OT devices including PLCs, HMIs and fuel management systems, and S9045 BACKUPOSINT v9.0 APEX PREDATOR, the AI-generated 49-module Python toolkit from the Mexico breach.
• Detection: ICS detection strategies now name the platforms (Windows, Linux, Network Devices, Embedded) and assets, such as an engineering workstation or PLC, they apply to. v20 adds 15 new detection strategies (6 Enterprise, 9 ICS) and 38 analytics, including 22 new ICS analytics tuned to set aside vendor software, engineering workflows and approved maintenance.
• Also in v20: NIMBUS MANTICORE (G1059), an IRGC-associated espionage group; updates to Salt Typhoon (edge device exploitation) and APT38 (supply chain); The Gentlemen ransomware with lockers for Windows, Linux, NAS, BSD and ESXi; and nine new Enterprise techniques and sub-techniques covering prompt injection and other AI abuse.
Who it affects: asset owners, SOC and detection engineering teams, integrators and vendors who map products or services to ATT&CK, and NERC CIP and IEC 62443 programs that tie controls and detections to ATT&CK techniques.
Where it shows up, plant floor to cloud:
• Field level: PLCs and embedded devices, the systems C0066 and IOControl reached.
• Control level: HMIs and engineering workstations, where PowerShell, command shell, Python and other interpreters run.
• Network: DNS and MQTT-style publish/subscribe traffic between OT zones and up to the enterprise.
• Enterprise and cloud: the SOC, SIEM and threat intel platforms that store ATT&CK mappings.
What the Red Tiger team recommends now:
1. Remap. Find every detection, threat model and control crosswalk that cites T0807 or T0853 and move it to T1701 and the right sub-technique.
2. Baseline DNS and pub/sub. Check whether DNS and MQTT-style publish/subscribe traffic in your OT zones is inventoried, baselined and monitored, and keep unapproved software off ICS assets in line with M1061.
3. Use C0066 as a tabletop. Confirm no PLC or HMI is reachable from the internet, and test how operators would recover if they were locked out of their own systems.
4. Tune against the plant. Review the new ICS analytics against your engineering and maintenance baseline before turning them on, so alerts point to activity outside normal operations.
We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min
Source: MITRE ATT&CK v20 release notes: https://attack.mitre.org/resources/updates/updates-october-2026/
MITRE ATT&CK blog (Amy L. Robertson): https://medium.com/mitre-attack/attack-v20-9701dd75ffb4
Check out our resources and book a follow-up call with our team.
