MITRE Unveils ATT&CK v18 With Updates to Detections, Mobile, ICS

MITRE has unveiled ATT&CK v18, announced on 29 October 2025, with substantial changes across detections, mobile, and ICS coverage. According to SecurityWeek, the update introduces two new detection objects—Detection Strategies and Analytics—aimed at defining high-level detection approaches and platform-specific threat logic.

In the Enterprise section, MITRE adds techniques for modern infrastructure, CI/CD pipelines, Kubernetes, and cloud databases, and v18 also includes ransomware preparation behaviours and attackers monitoring threat intelligence sources for information on their own campaigns. In the Mobile section, coverage has been expanded for adversaries abusing the linked devices feature in Signal and WhatsApp, with the abuse of accessibility features technique brought back after its deprecation in version 7.

The most significant ICS changes pertain to new assets such as distributed control system controllers, firewalls, and switches, with updated descriptions of existing assets. MITRE also announced the creation of the ATT&CK Advisory Council, offering a formal input channel from end users, vendors, government organisations and academia.