Uber Network Compromised by Hackers

**Executive summary:** On 15 September 2022 CRIL reported that threat actor "Tea Pot" compromised Uber by targeting an employee (via social engineering and MFA interception) to gain VPN and internal access; public screenshots allegedly show access to Slack, HackerOne, internal finance and intranet portals, Active Directory, GCP/AWS consoles, and SentinelOne, and CRIL maps the activity to MITRE ATT&CK techniques (phishing, MFA interception, valid accounts, remote service exploitation, cloud discovery, and adversary-in-the-middle).