MITRE Unveils ATT&CK v18 With Updates to Detections, Mobile, ICS

MITRE announced on Tuesday that its ATT&CK framework has been updated to version 18, with significant changes in several sections.

The organization said the October 2025 update of ATT&CK, the widely used knowledge base of adversary tactics and techniques, brings improvements in terms of techniques, groups, campaigns, and software.

The federally funded research and development center said the biggest modifications compared to ATT&CK v17 are related to the defensive content of ATT&CK.

Specifically, two new objects have been added to detections: Detection Strategies, which defines high-level approaches for detecting specific attacker techniques, and Analytics, which provides platform-specific threat detection logic.

In the Enterprise section, MITRE has added techniques pertaining to modern infrastructure, CI/CD pipelines, Kubernetes, and cloud databases. ATT&CK v18 also includes ransomware preparation behaviors, and attackers monitoring threat intelligence sources for information on their own campaigns.

In the cyber threat intelligence (CTI) section of ATT&CK v18, MITRE has ...