Attackers Used Qubole's AWS Trust to Reach Customer Clouds

An attacker turned a third-party data platform’s AWS access into a route into customer clouds, according to BleepingComputer. The report says compromised identity and access management credentials linked to Qubole’s AWS account were used to reach and take data from several AWS environments. The campaign ran between October 14 and 26, the publication reported, and affected tens of companies whose AWS setups had IAM roles trusting the Qubole account.

Qubole provides enterprise cloud data processing and analytics, including AWS integration. Customers can give outside providers access by creating cross-account IAM roles. Trust policies specify which external AWS accounts may take those roles, while permissions define what the role can do. Wiz, the cloud security firm that investigated, said external providers obtain temporary credentials through AWS’s STS AssumeRole API.

According to Wiz, the attacker compromised two Qubole IAM users and then took on roles in multiple customer AWS accounts that had been configured to trust Qubole’s account. The roles were otherwise unused, the researchers said, and the attacker operated within their permissions. Wiz began looking after Sentra, a data security and governance company, shared signs of suspicious activity in some customer environments; Mandiant also took part.

Wiz described a consistent pattern across environments: assume a role, list the buckets it could reach, enumerate and inspect objects, then download them. Before that, the attacker surveyed cloud resources, pulled secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables, according to the report. The attacker then used TruffleHog to check discovered AWS keys, Microsoft Entra ID client secrets and Okta client credentials. With deeper access, the actor downloaded data from all accessible S3 buckets, taking an opportunistic approach rather than selecting specific data, Wiz said.

The source does not state how the Qubole accounts were compromised or give an exact count of downstream victims. Sentra confirmed dozens of victims and said millions of files were stolen from one customer alone, according to BleepingComputer. Sentra also said the attacker moved quickly, collecting 100 passwords and keys in seven minutes.

BleepingComputer said it could not find a public Qubole announcement about the incident and had emailed the company for comment. Whether the issue has been patched, and what Qubole has done in response, is not established in the supplied material. Administrators who may be affected are advised to review CloudTrail from October 1 onward for suspicious access from Qubole’s AWS account; investigate later secret and S3 access; rotate exposed credentials; and revoke active role sessions. The guidance also calls for removing unused integrations and tightening remaining roles’ permissions, trusted identities and permitted source networks.

The confirmed facts are the reported campaign window, the use of compromised Qubole IAM users and trusted cross-account roles, Wiz’s account of the post-access activity, and Sentra’s victim and data-theft statements. The incident’s broader lesson—that third-party trust relationships can widen the blast radius of a credential compromise—is an interpretation, not a finding about Qubole’s security posture. The report does not establish negligence, a full victim tally, the initial access route, or remediation status.