Threat actor exploits Qubole cross-account AWS roles to breach multiple customer environments and steal S3 data
Between October 14 and 26, 2026, attackers abused compromised Qubole IAM credentials to assume trusted roles in multiple customer AWS accounts, enabling them to steal secrets and download entire Amazon S3 buckets. The intrusion leveraged dormant cross-account roles that remained enabled after organizations ceased using Qubole, allowing successful AssumeRole calls with valid External IDs. Credential theft from AWS Secrets Manager, SSM Parameter Store, and Lambda environment variables facilitated further access, with the attacker using tools like TruffleHog to validate stolen keys across multiple cloud services. While no known threat group attribution exists, a handle "non" claimed responsibility but remains unconfirmed. The attack highlights risks in maintaining legacy third-party IAM roles and underscores the need for timely revocation and monitoring of cross-account trust relationships.
Linha do tempo
-
Threat actor exploits Qubole cross-account AWS roles to breach multiple customer environments and steal S3 data
ler a análise desta fonte ocultar
Between October 14 and 26, 2026, attackers abused compromised Qubole IAM credentials to assume trusted roles in multiple customer AWS accounts, enabling them to steal secrets and download entire Amazon S3 buckets. The intrusion leveraged dormant cross-account roles that remained enabled after organizations ceased using Qubole, allowing successful AssumeRole calls with valid External IDs. Credential theft from AWS Secrets Manager, SSM Parameter Store, and Lambda environment variables facilitated further access, with the attacker using tools like TruffleHog to validate stolen keys across multiple cloud services. While no known threat group attribution exists, a handle "non" claimed responsibility but remains unconfirmed. The attack highlights risks in maintaining legacy third-party IAM roles and underscores the need for timely revocation and monitoring of cross-account trust relationships.