Who would be an Uber secops employee today ...

[Sinbad2000]

Looks like their entire infrastructure was owned via a social engineering attack, which allowed the actor to access their VPN. From there he found a network share with some powershell scripts - one of which had admin credentials for their password management system.
He got domain admin, google cloud admin, AWS admin, slack admin, HackerOne admin plus a whole bunch of other stuff.

From the PoV of someone in IT, this is terrifying to contemplate!

https://twitter.com/BillDemirkapi/status/1570602097640607744

 

[Sinbad2000]

Not saying this isn't bad but its not the worst. The attacker looks more like they are in it for the thrills given how open they are about it with media.
Imagine all this and add ransomware on top (don't ask me how i know, but i know the above feel + ransomware)

This is true...
Challenge now being to prove that no PI/PCI data was exfiltrated, and that no nasty little surprises have been left lying around.