Cloud Security Office Hours Banner

Uber 2022 — 2022

Step-by-step kill chain mapped to MITRE ATT&CK Cloud, sourced from official post-mortems and primary technical analyses.

September 15–16, 2022 Critical AWS GCP

Uber – Dark Web Creds → MFA Push Fatigue → Hardcoded PAM Secret → Full AWS/GCP Admin

An 18-year-old attacker purchased an Uber contractor's VPN credentials from a dark web infostealer marketplace, then used MFA push-bombing combined with WhatsApp social engineering to bypass two-factor auth. Once inside the corporate network, they found a PowerShell script with hardcoded admin credentials for Thycotic — Uber's PAM system — unlocking full admin access to AWS, GCP, Slack, SentinelOne, HackerOne, and more within hours.

Full admin on AWS, GCP, Slack, SentinelOne, HackerOne
<24 hours initial access to full compromise
Attacker: 18-year-old, allegedly LAPSUS$-affiliated
📄 Uber official security update ↗ 📄 GitGuardian technical analysis ↗
🛒 Initial Access — Purchased Credentials
01
Contractor VPN credentials purchased from dark web infostealer log
T1078 – Valid Accounts

The targeted contractor's device had previously been infected with infostealer malware, which exfiltrated saved browser credentials to a dark web marketplace. The attacker purchased the username and password — no zero-day or technical exploit required.

Source: Infostealer log purchased from dark web forum
Credential type: Uber contractor corporate VPN credentials
Defence gap: No monitoring for credential leakage · Third-party device not enrolled in MDM or health-checked before VPN access
InfostealerDark WebT1078Third-Party Risk
📱 MFA Bypass — Push Fatigue + Social Engineering
02
MFA push-bombing campaign + WhatsApp impersonation of Uber IT
T1621 – MFA Request Generation

The attacker repeatedly attempted VPN login, flooding the contractor's phone with MFA push notifications. After approximately an hour of notifications, they contacted the contractor on WhatsApp claiming to be Uber IT support and stating the only way to stop the notifications was to approve one. The contractor complied.

Technique: MFA push fatigue ("push bombing") for ~1 hour
Social engineering: WhatsApp message: "I'm from Uber IT. Accept the push to stop the notifications."
MFA type: Push notification (not phishing-resistant FIDO2)
Why it worked: No number-matching · No limit on push attempt rate
MFA FatiguePush BombingWhatsApp SET1621
🔌 Internal Recon
03
VPN established; contractor-level access used to enumerate internal network shares
T1046 – Network Service Discovery

Once the contractor approved the push, the attacker connected to Uber's corporate VPN and began scanning the internal network. Internal infrastructure had no micro-segmentation — a contractor VPN account could reach all internal file shares.

Access level at this point: Contractor VPN (low privilege)
Recon target: Internal file shares and intranet services
Defence gap: No east-west network segmentation · Contractor VPN had broad internal network visibility
VPNInternal ReconNo SegmentationT1046
💀 Critical Discovery — Hardcoded Secret
04
PowerShell script on internal share contained hardcoded Thycotic PAM admin credentials
T1552.001 – Credentials in Files

On an internal network share accessible via the contractor VPN, the attacker found a PowerShell script containing plaintext admin credentials for Thycotic — Uber's Privileged Access Management platform. This single file became the skeleton key to every system in the organisation.

Location: Internal network share (contractor VPN accessible)
Contents: Hardcoded Thycotic domain admin username + password in plaintext
Irony: Thycotic was the PAM system specifically designed to prevent hardcoded secrets
Root cause: Automation script needed PAM API access but used a static credential instead of a scoped service account
Hardcoded CredentialsPowerShellT1552.001Secrets Sprawl
👑 Total Compromise — Keys to the Kingdom
05
Thycotic admin access → all secrets extracted → full cloud and SaaS compromise
T1078.004 – Cloud Accounts

Using the admin credentials, the attacker logged into Thycotic and extracted all stored secrets. Thycotic was the single source of truth for credentials across Uber's entire cloud and SaaS footprint.

Systems fully compromised:
→ AWS (cloud infrastructure admin)
→ GCP + Google Workspace (admin)
→ Slack workspace (admin — used to announce breach to all Uber employees)
→ SentinelOne XDR (admin — ability to suppress security alerts)
→ HackerOne admin console (access to private vulnerability reports)
→ DUO, OneLogin, VMware vSphere, Uber internal dashboards
PAM TakeoverAWS AdminGCP AdminFull Compromise
🚨 Discovery
06
Attacker self-announces the breach in Uber's company Slack

The attacker used their Slack admin access to broadcast a message to all Uber employees announcing the breach, then posted screenshots on Twitter under "teapotuberhacker." Uber's security team discovered the breach within hours — not through monitoring, but through the attacker's announcement.

Discovery method: Attacker self-announced in company-wide Slack
Key gap: No alert fired on new AWS admin account creation · No alert on PAM admin login from unknown device
SentinelOne access meant: The attacker could have suppressed EDR alerts to cover tracks
Self-AnnouncedNo Internal DetectionSlack Admin Abuse

🛡 How to Defend Against This Chain

Deploy phishing-resistant MFA (FIDO2 / hardware security keys). Push notification MFA is defeated by fatigue attacks. Number-matching — requiring users to match a code shown on screen — stops automated bombing. FIDO2/passkeys are immune to both fatigue and phishing.
Never hardcode credentials in scripts — use dynamic secrets from your PAM. Scripts should authenticate to your PAM via a scoped, short-lived service account, or use cloud-native options (AWS Secrets Manager, GCP Secret Manager with Workload Identity). Run Trufflehog or GitLeaks in CI/CD.
Segment your network so contractor VPNs cannot reach all internal shares. Contractors should only access resources their role requires. A contractor VPN with visibility across all internal file shares is a single-hop lateral movement risk.
Alert on anomalous PAM admin logins immediately. PAM is the crown jewels. A PAM admin login from a new device, new IP, or at an unusual time should trigger an immediate alert — not a periodic review.
Enrol contractor devices in MDM and require health attestation before VPN admission. Device health checks can catch infostealer infections before they translate into credential theft.