# Uber breach claimed by Helix ransomware gang

Published: 2026-08-07 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/acd3de34-7f9f-57e4-bee0-a6b851cf9010/uber-breach-claimed-by-helix-ransomware-gang

> Helix ransomware operators claim compromise of Uber with theft of employee credentials and exposure of external attack surface.

Ransomware.live has indexed a claim by the Helix ransomware group regarding a compromise of Uber. According to the posting, the intrusion resulted in compromise of three user accounts, thirteen third-party employee credentials, and exposure of two points on Uber's external attack surface. The claim includes DNS record data and a leaked screenshot. Helix operators typically use stolen credentials and reconnaissance data as leverage for extortion demands. The specific attack vector, payload deployment, and data exfiltration methods are not detailed in this public index entry. Defenders at Uber and partner organizations should assume credential compromise and prioritize hunting for anomalous access patterns, particularly from the thirteen compromised third-party credentials, and review DNS configuration for unauthorized changes.

## Mentioned in this report

- Threat actors: Helix
- Malware: Helix

## Detection guidance (public sample)

### Azure AD MFA Prompt Denied or Unanswered (Possible MFA Fatigue)

ATT&CK: T1621

Azure AD sign-in failure 500121 (MFA failed or not answered), the per-event signal for MFA push bombing; alert on repeated hits per user. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Azure AD MFA Prompt Denied or Unanswered (Possible MFA Fatigue)
description: Detects Azure AD sign-in failures with error 500121 (strong authentication
  failed, e.g. push denied or unanswered). Individual events are common; the malicious
  pattern is many of these for one user in a short window (for example 5 or more in
  10 minutes), which should be applied as a SIEM threshold on UserPrincipalName.
tags:
- attack.credential-access
- attack.t1621
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: '500121'
  condition: selection
falsepositives:
- Users who mistype or ignore a legitimate MFA prompt once or twice
- Users with stale or changed authenticator devices
level: low
id: 7ed9926f-caee-5d6b-bd26-50b1a8ab00ec
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VWJlckBIZWxpeA==
```

### Azure AD Smart Lockout Triggered by Repeated Failed Sign-ins

ATT&CK: T1110

Azure AD sign-in error 50053 (account locked after repeated bad credentials), indicating password guessing or spraying against an account. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Azure AD Smart Lockout Triggered by Repeated Failed Sign-ins
description: Detects Azure AD sign-in events with error 50053 (account locked due
  to repeated sign-in attempts with an incorrect password), a strong indicator of
  brute force or password spraying against user or third-party accounts. Correlate
  across users and source IPs to identify spraying.
tags:
- attack.credential-access
- attack.t1110
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: '50053'
  condition: selection
falsepositives:
- Users with stale saved passwords on mobile devices or mail clients causing lockouts
- Misconfigured service accounts using an old password
level: medium
id: 85e7b5e2-ad45-5f83-80cc-963262603e18
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/VWJlckBIZWxpeA==
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/VWJlckBIZWxpeA==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/acd3de34-7f9f-57e4-bee0-a6b851cf9010/uber-breach-claimed-by-helix-ransomware-gang.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup