Uber Freight is investigating a data security incident after the Helix extortion group claimed to have stolen nearly 1 million files from the logistics company. Helix listed Uber Freight on its data leak site on August 6, alleging compromise of mailboxes, OneDrive accounts, and accounts receivable data, among other repositories.
An Uber Freight spokesperson confirmed that an investigation is underway into unauthorized access to a portion of its systems and repositories. The company stated that the incident was identified, contained, and remediated, and that federal law enforcement was promptly engaged. Uber Freight emphasized that its business operations have not been impacted and continue normally, with systems remaining secure and fully operational.
The company, which describes itself as one of North America's largest managed transportation and multimodal capacity networks, manages 18 million shipments annually, valued at over $17 billion. Uber Freight did not confirm or deny the authenticity of the files released by Helix.
Helix is one of several recently established extortion brands that security researchers have linked to infrastructure previously associated with BlackFile, which ceased operations in May. Google Threat Intelligence Group (GTIG) tracks Helix, along with the Pink, Redact, and Falcon brands, as part of a wider cluster of activity designated UNC6671.
Operators associated with UNC6671 frequently employ vishing tactics to gain initial access. This typically involves posing as IT helpdesk staff overseeing mandatory security migrations, contacting employees on their personal phones, and using device code phishing to obtain credentials and authenticated sessions. Once access is gained, data is siphoned from cloud services such as Microsoft 365. These groups have also targeted Okta identity infrastructure.
Researchers indicate that UNC6671-linked brands have recently shifted their focus toward higher-value sectors. Since June, they have primarily targeted technology, transportation, and hospitality organizations, a change from their April and May focus on manufacturing, real estate, healthcare, and insurance.
The emergence of multiple brands following BlackFile's shutdown is subject to various interpretations. GTIG suggests this strategy could serve to compartmentalize operations, obscure overall breach volumes, and isolate any negative fallout from negotiations. Other potential explanations include internal disagreements among core members regarding finances or operational security, leading to fragmentation. It is also possible that core members aim to retain control over the intrusion and data theft aspects of attacks while outsourcing negotiations and extortion, or that different groups are simply utilizing the same commoditized phishing tools.
