Uber breach claimed by Helix ransomware gang

7 August 2026 routine threat technology

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Helix ransomware operators claim compromise of Uber with theft of employee credentials and exposure of external attack surface.

Ransomware.live has indexed a claim by the Helix ransomware group regarding a compromise of Uber. According to the posting, the intrusion resulted in compromise of three user accounts, thirteen third-party employee credentials, and exposure of two points on Uber's external attack surface. The claim includes DNS record data and a leaked screenshot. Helix operators typically use stolen credentials and reconnaissance data as leverage for extortion demands. The specific attack vector, payload deployment, and data exfiltration methods are not detailed in this public index entry. Defenders at Uber and partner organizations should assume credential compromise and prioritize hunting for anomalous access patterns, particularly from the thirteen compromised third-party credentials, and review DNS configuration for unauthorized changes.

Mentioned in this report

Threat actors Helix

Malware Helix

Detection guidance

Azure AD MFA Prompt Denied or Unanswered (Possible MFA Fatigue)

ATT&CK T1621

Azure AD sign-in failure 500121 (MFA failed or not answered), the per-event signal for MFA push bombing; alert on repeated hits per user. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Azure AD MFA Prompt Denied or Unanswered (Possible MFA Fatigue)
description: Detects Azure AD sign-in failures with error 500121 (strong authentication
  failed, e.g. push denied or unanswered). Individual events are common; the malicious
  pattern is many of these for one user in a short window (for example 5 or more in
  10 minutes), which should be applied as a SIEM threshold on UserPrincipalName.
tags:
- attack.credential-access
- attack.t1621
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: '500121'
  condition: selection
falsepositives:
- Users who mistype or ignore a legitimate MFA prompt once or twice
- Users with stale or changed authenticator devices
level: low
id: 7ed9926f-caee-5d6b-bd26-50b1a8ab00ec
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VWJlckBIZWxpeA==

Azure AD Smart Lockout Triggered by Repeated Failed Sign-ins

ATT&CK T1110

Azure AD sign-in error 50053 (account locked after repeated bad credentials), indicating password guessing or spraying against an account. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Azure AD Smart Lockout Triggered by Repeated Failed Sign-ins
description: Detects Azure AD sign-in events with error 50053 (account locked due
  to repeated sign-in attempts with an incorrect password), a strong indicator of
  brute force or password spraying against user or third-party accounts. Correlate
  across users and source IPs to identify spraying.
tags:
- attack.credential-access
- attack.t1110
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: '50053'
  condition: selection
falsepositives:
- Users with stale saved passwords on mobile devices or mail clients causing lockouts
- Misconfigured service accounts using an old password
level: medium
id: 85e7b5e2-ad45-5f83-80cc-963262603e18
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VWJlckBIZWxpeA==

1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/VWJlckBIZWxpeA==

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs