Wiz and Mandiant trace activity to a Qubole AWS account
Wiz, working with Google’s Mandiant incident responders after AI data‑security company Sentra flagged suspicious activity, traced malicious access back to October 14. The calls that led to the compromise originated from Qubole’s AWS account 805246085872 and used IAM user ID AIDA3W7DIFLYOLTK63SFS, Wiz analysts Zack Morrow, Sean Johnstone, and Benjamin Read wrote in a Monday blog about the supply‑chain attack. Neither AWS nor Qubole responded to The Register’s inquiries, and Wiz declined to say how many organizations were affected, describing the intrusion as a “broad, opportunistic supply chain campaign” that hit “multiple” customer environments.
Method: sts:AssumeRole and abused cross‑account integration roles
Qubole operates as a cloud data‑processing platform that uses cross‑account IAM roles so it can manage compute and access storage in customer AWS environments without long‑lived customer access keys. The attackers abused that third‑party trust by calling the sts:AssumeRole API to obtain temporary credentials for customer‑managed integration roles. Wiz says the first IAM user they observed called AssumeRole on October 14, activity continued on October 15, and a second IAM user from the same Qubole account began appearing on October 18.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat the intruders accessed and stole
Once the attackers gained access, Wiz observed probing across many AWS services and the theft of credentials, keys, and other secrets stored in Lambda, AWS Secrets Manager, and SSM Parameter Store. The miscreants used TruffleHog to test AWS credentials they found inside victim environments, discovered Microsoft Entra ID secrets, and requested OAuth tokens using Okta client credentials recovered while snooping. Abusing the integration roles also allowed data exfiltration from customer S3 buckets; in some incidents attackers downloaded entire buckets, which Wiz characterized as opportunistic rather than a targeted, single‑data hunt.
Timeline, parallel activity, and attribution limits
Wiz traced the primary malicious activity to October 14–18. While investigating, the firm also spotted a separate campaign between October 8 and October 11 that used customer‑owned AWS access keys for Qubole integrations; a “small number” of those events also resulted in compromises, but Wiz could not definitively link the two campaigns. Wiz’s CIRT reported, “Across the affected environments, Wiz CIRT has not observed this IAM user in any activity other than that associated with this threat actor.” The threat hunters have not attributed the supply‑chain attack to any particular group and said they do not have insight into how the miscreants are using the stolen data.
What this means for security teams, procurement leaders, and Qubole customers
- Security teams: Review CloudTrail from October 1 onward for AssumeRole events where userIdentity.accountId equals 805246085872, especially those originating from non‑AWS IP addresses; for every role session found, review all subsequent activity, focusing on Secrets Manager, SSM Parameter Store, Lambda and S3.
- Procurement and platform admins: The incident underlines the risk of long‑standing cross‑account trust policies — Wiz notes many organizations left trust policies active even after deprecating the platform. Organizations should inventory third‑party integrations and remove or tighten deprecated trust relationships.
- Qubole customers: Rotate credentials that could be read by an assumed integration role; but note that rotating a credential does not terminate already issued temporary sessions. Wiz specifically advises rotating every secret, parameter and Lambda environment variable the role could read, and revoking active sessions for the role.
Closing: actionable signals, lingering questions
The concrete signals in this campaign are precise: calls to sts:AssumeRole from Qubole’s AWS account 805246085872, the IAM user ID AIDA3W7DIFLYOLTK63SFS, and lateral access to Lambda, Secrets Manager, SSM Parameter Store and S3. Those indicators give defenders a clear starting point for investigation and containment. What remains unanswered is the scope of affected organizations and the ultimate use of the stolen secrets and data — questions Wiz, Mandiant, Sentra, Qubole and AWS have not closed in public comments. For now, the immediate work for defenders is inventory, audit of cross‑account roles, rotation of secrets, and session revocation where integration roles were assumed.
