Qubole's AWS account credentials abused via stale IAM cross-account trust to steal data from dozens of customer environments
Matéria consolidada. Reúne 10 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 7 fontes trouxeram em 13/11/2026 12:03; os links antigos trazem para cá.
Fontes: securityonline.info ↗ bleepingcomputer.com ↗ securityweek.com ↗ gbhackers.com ↗ theregister.com ↗ thehackernews.com ↗ wiz.io ↗
An unidentified threat actor used compromised IAM credentials tied to Qubole's AWS account to assume cross-account IAM roles in customer AWS environments, then enumerated resources, harvested secrets and exfiltrated data. Activity ran from about October 14 to October 26, 2026 (gbhackers.com, bleepingcomputer.com, securityonline.info). Many of the roles were dormant or left over from abandoned Qubole integrations, but still trusted the vendor account (securityweek.com, gbhackers.com). securityonline.info adds that these cross-account roles stayed enabled after organizations stopped using Qubole, and that AssumeRole calls succeeded with valid External IDs. Wiz, in collaboration with Sentra and Mandiant, identified the intrusion (wiz.io, bleepingcomputer.com). The number of victims is reported as anywhere from "multiple" to "dozens". The activity looks opportunistic, with no evidence of targeted or state-backed involvement (securityweek.com). A handle "non" reportedly claimed responsibility, but this is unconfirmed and no known threat group has been attributed (securityonline.info). At the time of the latest source on the incident's response (November 10), no public statement from Qubole had been reported (bleepingcomputer.com).
Detalhes técnicos
- Initial access: compromised vendor IAM credentials were used for unauthorized
AssumeRole(STS) calls originating from outside AWS. The attacker relied on trust policies in the customers' roles, including roles that were unused or left over from past integrations (thehackernews.com, theregister.com, bleepingcomputer.com). The calls succeeded with valid External IDs (securityonline.info). - Data and secret access: the attacker accessed and exfiltrated data from S3 buckets, Secrets Manager, Lambda environment variables/configurations and SSM Parameter Store (thehackernews.com, theregister.com, securityonline.info). Credentials were also collected from EC2 user data (gbhackers.com).
- Mass theft: several compromised credentials were used to enumerate buckets and download entire datasets (gbhackers.com, securityweek.com). securityonline.info likewise reports entire Amazon S3 buckets being downloaded.
- Tooling: TruffleHog was used to validate harvested credentials (gbhackers.com, securityweek.com), reportedly across multiple cloud services (securityonline.info). The attacker used consistent session naming conventions (securityweek.com).
- Infrastructure: activity came from a rented OVH-hosted server and Mullvad VPN addresses, with none from Qubole's own network (securityweek.com, gbhackers.com).
- Persistence: the attacker sometimes stayed dormant for months (gbhackers.com).
- Unexplained artifact: an unusual ISO file deployment was observed, suggesting additional malicious capability (wiz.io). Other sources do not mention it.
- Detection: monitor CloudTrail for suspicious
AssumeRoleactivity, especially from known attacker IP addresses and IAM principal IDs (thehackernews.com).
Remediação
- Review AWS CloudTrail logs from October 1 onward for suspicious
AssumeRoleevents (gbhackers.com, theregister.com). - Restrict or remove trust relationships, especially roles for Qubole integrations that are no longer in use (gbhackers.com, securityweek.com, securityonline.info). Revoke legacy third-party roles promptly and monitor cross-account trust relationships (securityonline.info).
- Rotate credentials and secrets stored in Secrets Manager, SSM Parameter Store, Lambda environment variables and EC2 user data (gbhackers.com, theregister.com).
- Revoke active sessions (theregister.com, bleepingcomputer.com).
Relatos divergentes
- Scope: wiz.io, thehackernews.com, theregister.com and securityonline.info say only "multiple" victims. securityweek.com says "over a dozen" organizations. gbhackers.com and bleepingcomputer.com say "dozens". The exact number is unconfirmed.
- Timeframe: theregister.com says activity started "around October 14". gbhackers.com, bleepingcomputer.com and securityonline.info give a defined window of October 14 to 26, 2026 (securityonline.info is the most recent). gbhackers.com also notes the attacker was sometimes dormant for months.
- Root cause wording: theregister.com describes "misconfigured or leftover" trust policies. securityweek.com, gbhackers.com and securityonline.info stress dormant roles from abandoned integrations. All are consistent with stale trust, but no source gives the exact credential compromise vector.
- Attribution: securityonline.info (the most recent) reports that a handle "non" claimed responsibility but says this remains unconfirmed and that no known threat group is attributed. The other sources do not name the actor. securityweek.com assesses it as opportunistic, with no state-backed indications.
Linha do tempo
-
Threat actor exploits Qubole cross-account AWS roles to breach multiple customer environments and steal S3 data
ler a análise desta fonte ocultar
Between October 14 and 26, 2026, attackers abused compromised Qubole IAM credentials to assume trusted roles in multiple customer AWS accounts, enabling them to steal secrets and download entire Amazon S3 buckets. The intrusion leveraged dormant cross-account roles that remained enabled after organizations ceased using Qubole, allowing successful AssumeRole calls with valid External IDs. Credential theft from AWS Secrets Manager, SSM Parameter Store, and Lambda environment variables facilitated further access, with the attacker using tools like TruffleHog to validate stolen keys across multiple cloud services. While no known threat group attribution exists, a handle "non" claimed responsibility but remains unconfirmed. The attack highlights risks in maintaining legacy third-party IAM roles and underscores the need for timely revocation and monitoring of cross-account trust relationships.
-
Hackers exploit trusted AWS access to breach multiple cloud environments
ler a análise desta fonte ocultar
A threat actor exploited compromised IAM credentials associated with Qubole's AWS account to access and exfiltrate data from multiple customer environments. The attackers assumed unused roles in victims' AWS accounts configured to trust Qubole, surveyed resources, retrieved secrets, and downloaded data opportunistically. The campaign ran from October 14 to 26, affecting dozens of companies. Security firms Wiz, Sentra, and Mandiant investigated the incident, which involved misuse of AWS’s STS AssumeRole API and tools like TruffleHog. No public statement from Qubole has been made yet, but recommendations include credential rotation, log review, and revoking active sessions.
-
Qubole supply chain attack exploits stale IAM roles to exfiltrate data from multiple organizations
ler a análise desta fonte ocultar
Cybersecurity researchers uncovered a campaign where an attacker used compromised IAM credentials linked to Qubole's AWS account to access and exfiltrate data from over a dozen different organizations' environments. The breach exploited dormant cross-account IAM roles that remained active long after organizations had ceased using Qubole, enabling the attacker to enumerate resources, collect secrets, and download entire S3 buckets. The activity was conducted from a rented OVH server and Mullvad VPN, with no activity originating from Qubole's network. The attacker used consistent session naming conventions and standard tools like TruffleHog to identify valid credentials, with no evidence of targeted or state-backed activity, suggesting opportunistic motives.
-
Hackers Abuse Qubole's Trusted AWS Access to Breach Multiple Cloud Accounts and Steal Sensitive Data
ler a análise desta fonte ocultar
Hackers exploited AWS credentials associated with Qubole to breach dozens of customer cloud environments between October 14 and October 26, 2026. They leveraged existing trust relationships and abandoned vendor integrations, utilizing IAM role assumption to access and exfiltrate sensitive data from S3 buckets, Lambda configurations, and other AWS services. The campaign employed techniques such as credential collection via Secrets Manager, Systems Manager Parameter Store, and EC2 user data, and used tools like TruffleHog for validation. Several compromised credentials were used to enumerate buckets and download entire datasets, leading to mass data theft. The attackers showed operational persistence, sometimes dormant for months, and employed threat infrastructure associated with Mullvad VPN addresses and OVH-hosted servers. Organizations are advised to review CloudTrail logs from October 1 onward, restrict trust relationships, rotate secrets, and revoke active sessions.
-
Supply-chain attack exploits Qubole AWS trust relationships to steal secrets
ler a análise desta fonte ocultar
Unknown attackers compromised IAM credentials linked to Qubole's AWS account to access customer environments and exfiltrate secrets and sensitive data. The attack leveraged misconfigured or leftover trust policies allowing unauthorized role assumption, leading to credential harvesting and secret theft from services like Lambda, Secrets Manager, and SSM Parameter Store. The threat activity started around October 14 and involved multiple IAM users. Organizations using Qubole are advised to rotate credentials, review AWS CloudTrail logs for suspicious 'AssumeRole' activity, and revoke active sessions. This broad, opportunistic campaign highlights the security risks of third-party trust relationships in cloud environments.
-
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
ler a análise desta fonte ocultar
An attacker compromised AWS accounts linked to multiple Qubole customers by exploiting trusted IAM roles, gaining access to credentials, secrets, and data stored across various AWS services. The breach involved unauthorized AssumeRole requests from outside AWS, leveraging the trust established by the roles' policies. Despite many roles remaining unused, the attacker was able to access and exfiltrate data from S3 buckets, Secrets Manager, Lambda environment variables, and SSM Parameter Store. Detection involved monitoring CloudTrail logs for suspicious AssumeRole activity, particularly from known attacker IP addresses and IAM principal IDs.
-
Qubole cross-account trust exploited for cloud intrusion in October 2026
ler a análise desta fonte ocultar
Wiz, in collaboration with Sentra and Mandiant, identified a sophisticated attack leveraging abused IAM cross-account trust relationships between Qubole and customer AWS environments. The threat actor used compromised vendor credentials to assume unsuspected IAM roles, enabling resource enumeration, data exfiltration, and credential harvesting across multiple victims. An unusual ISO file deployment was also detected, suggesting additional malicious capabilities. This incident underscores the risks associated with third-party integrations and highlights detection and mitigation strategies to defend cloud assets.