Rockstar Games & Uber Breached by Supposed Lapsus$ Threat Actor

Video game giant Rockstar Games has suffered a massive social engineering attack which resulted in exfiltrated videos of the upcoming Grand Theft Auto VI game. A user by the tag name “teapotuberhacker”, tracked as TeaPot, leaked around ninety (90) videos to GTAForums which contained confidential development footage of the next Grand Theft Auto, supposedly extracted from a compromised Rockstar Games Slack channel. In addition, TeaPot also claimed to be in possession of Grand Theft Auto V/VI source code, associated assets, and test realms. This same threat actor has claimed responsibility for the crippling cyber-attack on Uber late last week. Attributed to Lapsus$, TeaPot claimed that they gained unauthorized access into several Uber Technologies systems including Slack channels, AWS, Google Workspace, virtual machines, and their HackerOne bug bounty filing system. The point of compromise in this attack was a successful social engineering attack against an Uber employee through WhatsApp, which ultimately led to the disclosure of account credentials. Several days later, Uber released a statement acknowledging the breach and claiming Lapsus$ as responsible, stating extortion from the group was a high possibility. While not yet confirmed, Lapsus$ is believed to be behind the Rockstar Games breach based on threat actor tactics, techniques, and procedures. CTIX will continue to monitor the fallout of these cyber-attacks and will provide an update as more information is released.