Hijacked Qubole AWS credentials open the door to dozens of customer clouds

Attackers hijacked two Qubole IAM users and rode that trusted AWS access straight into other companies' clouds, exfiltrating data from as many as dozens of victims. The campaign ran from October 14 to 26, hitting businesses whose AWS environments had cross-account IAM roles set up to trust Qubole's AWS account. Cloud security firm Wiz investigated alongside Mandiant after data governance company Sentra flagged suspicious activity in some customer environments.

Here's how the break-in worked: companies hand third-party providers like Qubole access through cross-account IAM roles, with trust policies naming which outside accounts can take those roles. The attackers used AWS's STS AssumeRole API to grab temporary credentials and slip into roles customers had left sitting unused. Qubole, an enterprise cloud data processing and analytics platform, hasn't publicly announced the incident — BleepingComputer emailed the company and is waiting on a reply.

Once inside, the intruders went shopping. Wiz says they surveyed cloud resources, pulled secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables. Then they ran TruffleHog to validate the AWS keys, Microsoft Entra ID client secrets and Okta client credentials they'd found. Wiz described a repeatable pattern: assume a role, call ListBuckets to see what's reachable, enumerate contents with ListObjects and HeadObject, then GetObject to download it all.

The haul was sloppy and fast rather than surgical. Attackers grabbed data from every accessible S3 bucket because they could, not because they wanted it. Sentra says the operation moved at a clip of 100 passwords and keys harvested in seven minutes, and confirmed dozens of victims plus millions of files stolen from a single customer. The report doesn't say how the Qubole accounts were compromised or pin down the final victim count.

Admins who might be caught up in this are told to comb CloudTrail from October 1 onward for suspicious access from Qubole's AWS account, then trace any secret and S3 activity that followed. The recommended cleanup: rotate exposed credentials, kill active role sessions, drop integrations nobody uses anymore, and tighten remaining roles' permissions, trusted identities and allowed source networks.