MITRE announced on Tuesday that its ATT&CK framework has been updated to version 18, with significant changes in several sections.
The organization said the October 2025 update of ATT&CK, the widely used knowledge base of adversary tactics and techniques, brings improvements in terms of techniques, groups, campaigns, and software.
The federally funded research and development center said the biggest modifications compared to ATT&CK v17 are related to the defensive content of ATT&CK.
Specifically, two new objects have been added to detections: Detection Strategies, which defines high-level approaches for detecting specific attacker techniques, and Analytics, which provides platform-specific threat detection logic.
In the Enterprise section, MITRE has added techniques pertaining to modern infrastructure, CI/CD pipelines, Kubernetes, and cloud databases. ATT&CK v18 also includes ransomware preparation behaviors, and attackers monitoring threat intelligence sources for information on their own campaigns.
In the cyber threat intelligence (CTI) section of ATT&CK v18, MITRE has added new groups and campaigns, as well as software linked to supply chain attacks, cloud identity exploitation, and attacks aimed at virtualization and edge systems.
In the Mobile section, coverage has been added for adversaries abusing the ‘linked devices’ feature in Signal and WhatsApp. Also in this section, the ‘abuse accessibility features’ technique has been brought back after it was deprecated in version 7 of ATT&CK.
The most significant changes in the industrial control systems (ICS) section are related to new assets and updates to the descriptions of existing assets. The new assets are distributed control system controllers, firewalls, and switches.
MITRE on Tuesday also announced the creation of the ATT&CK Advisory Council, which provides a formal channel for input from advisors representing end users, vendors, government organizations, and academia.
Related: MITRE Updates List of Most Common Hardware Weaknesses
Related: MITRE Unveils AADAPT Framework to Tackle Cryptocurrency Threats
Related: MITRE Publishes Post-Quantum Cryptography Migration Roadmap
