The Evolution of Attack Techniques and Their Growing Complexity: A Longitudinal Analysis of MITRE ATT&CK, 2020–2026, and Its Implications for Detection

Jini Peter Fernandez

The Evolution of Attack Techniques and Their Growing Complexity: A Longitudinal Analysis of MITRE ATT&CK, 2020–2026, and Its Implications for Detection

Author(s)	Mr. Jini Peter Fernandez
Country	Saudi Arabia
Abstract	Attack techniques have changed from self-propagating worms to targeted, multi-stage campaigns that abuse legitimate tools, identities, cloud services and software supply chains. Most accounts of this change are narrative. This paper combines a narrative review with a longitudinal measurement of MITRE ATT&CK, the most widely used public knowledge base of adversary behavior. Using the official release notes of thirteen Enterprise ATT&CK releases from July 2020 (v7) to April 2026 (v19), we measure how documented adversary behavior grew. The number of documented techniques and sub-techniques rose from 428 to 697 (+63%), with sub-techniques growing faster than techniques (+75% versus +42%). From October 2023 to April 2026, documented campaigns more than doubled, from 23 to 56. The framework also expanded to new platforms, including network devices, containers and software-as-a-service applications. We then trace six shifts in attack vectors: mass-propagating malware, targeted advanced persistent threats, ransomware as a criminal business, living off the land, identity and supply-chain compromise, and AI-assisted operations. We argue that complexity has grown less through new attack categories than through finer variation within known behaviors, more platforms, and greater use of legitimate tools. These trends shift detection away from signatures toward behavioral, context-rich and continuously maintained detection engineering, and we discuss implications for SIEM and security operations practice.
Keywords	Attack Techniques, MITRE ATT&CK, Threat Landscape, Advanced Persistent Threats, Ransomware, Living off the Land, Supply Chain Attacks, Detection Engineering
Field	Computer > Network / Security
Published In	Volume 7, Issue 6, November-December 2026
Published On	2026-11-11

View / Download PDF File

E-ISSN 3048-7641

doi

CrossRef DOI is assigned to each research paper published in our journal.

AIJFR DOI prefix is
10.63363/aijfr

Downloads

Research Paper Format Copyright Permission Form and Undertaking Form Cover Page Vol 7 Isu 6 Cover Page Vol 7 Isu 4 Cover Page Vol 7 Isu 3

All research papers published on this website are licensed under Creative Commons Attribution-ShareAlike 4.0 International License, and all rights belong to their respective authors/researchers.

CC-BY-SA

About AIJFR Fees & Payment Current Issue Publication Archive	Submit Research Paper Track Submission Status Publication Guidelines Publication Ethics Peer Review & Plagiarism	Join as a Reviewer Editors & Reviewers Reviewer Referral Program Get Reviewer Membership Certi.	Website/Journal Policies Usage Policy Content Policies Privacy Policy

Contact Us		+91-9898-79-39-59	editor@aijfr.com

Advanced International Journal for Research

A Widely Indexed Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

The Evolution of Attack Techniques and Their Growing Complexity: A Longitudinal Analysis of MITRE ATT&CK, 2020–2026, and Its Implications for Detection

Share this