Uber, one of the largest rideshare companies, confirmed via Twitter that they are investigating a security incident involving their internal network. The threat actor claiming responsibility for the attack reached out to The New York Times and shared screenshots of internal emails, cloud storage, and code repositories to validate their claims. The attacker stated they were an eighteen (18) year old male who has been practicing cybersecurity skills for years. At 3 PM on September 15, 2022, the threat actor posted a message in Uber’s internal Slack channel stating, “I announce I am a hacker and uber has suffered a data breach.” Initially, the Uber employees assumed the message was a joke, until employees started noticing any web requests made were redirected to a page with explicit content. The threat actor was able to gain administrative access to the organization’s Amazon Web Service (AWS) and Google Cloud Platform (GCP), the platforms that host the company’s internal services. They were also able to access Uber’s HackerOne account, a bug bounty service for hackers to report vulnerabilities to the organization. This account could include sensitive vulnerabilities that have not been patched yet; if the reported vulnerabilities are leaked, it could lead to a serious threat to Uber and its user’s security. The threat actor gained access to Uber’s systems by phishing a user and gaining access to their credentials. The attacker then attempted to sign in using the compromised credentials, spamming the user with multifactor authentication requests. Eventually, the threat actor resorted to messaging the user on WhatsApp claiming to be Uber IT and asking the user to accept the authentication request. This attack vector is very similar to the attacks conducted by the teenagers who ran the LAPSUS$ group. Once the threat actor gained access to the account, they discovered a PowerShell script with hardcoded administrator credentials, granting them access to the rest of the infrastructure. While Uber has stated they are responding to this incident and have contacted law enforcement, no other updates have been posted at the time of writing. CTIX analysts will continue to monitor this situation and will provide updates for any new developments.