“The attacker moved quickly and collected secrets at a rate of 100 passwords and keys in seven minutes,” Sentra told researchers — a rapid sweep that left tens of downstream cloud environments exposed and, in at least one case, millions of files taken.
Timeline and scope: October 14–26, tens of affected companies
Researchers at cloud security company Wiz traced a campaign that ran between October 14 and October 26, using compromised credentials tied to a Qubole AWS account to reach multiple customers’ AWS environments. The incident affected “tens of companies” whose AWS environments had cross-account IAM roles configured to trust Qubole’s account, Wiz reports. Sentra, a data security and governance firm, confirmed dozens of victims and said one customer lost millions of files.
How the access model was abused: cross-account IAM roles and STS AssumeRole
Qubole, an enterprise cloud data processing and analytics platform with AWS integration, can be granted access to customer AWS resources by creating cross-account IAM roles. Trust policies determine which external AWS accounts can assume those roles. Wiz explains that external providers commonly obtain temporary credentials by calling AWS’s STS AssumeRole API — the same mechanism the attacker used after compromising two Qubole IAM users.
Wiz found the attacker assumed otherwise unused roles in multiple customers’ accounts that had been configured to trust Qubole’s AWS account. The report does not specify how the Qubole IAM users were compromised, nor does it list an exact count of downstream victims.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildActions taken by the attacker: secrets, enumeration, and mass S3 downloads
Once inside, the actor performed a repeatable sequence across environments. Wiz documents the pattern: assume a role, call ListBuckets to determine reachable storage, call ListObjects and HeadObject to enumerate and inspect contents, then call GetObject to download them. The attacker surveyed resources, retrieved secrets from AWS Secrets Manager and from SSM Parameter Store, and read Lambda environment variables.
Wiz also reports the attackers used the open-source TruffleHog tool to validate discovered credentials — including AWS keys, Microsoft Entra ID client secrets, and Okta client credentials — before escalating activity. Rather than appear to target specific repositories, the actor adopted an opportunistic approach and downloaded data from all accessible S3 buckets in each compromised environment.
Investigation partners and public disclosure status
Wiz initiated its investigation after Sentra shared suspicious activity observed in customer environments. The probe included work by cybersecurity company Mandiant. BleepingComputer could not find a public announcement from Qubole about the incident and has emailed the company for comment; the outlet is awaiting a response.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Review CloudTrail logs from October 1 onward for suspicious activity originating from Qubole’s AWS account, investigate subsequent secret and S3 access, rotate any exposed credentials, and revoke active role sessions. Remove unused integrations and tighten role permissions, trusted identities, and permitted source networks.
- Procurement and platform managers: Reassess third-party access models that rely on cross-account IAM roles. Where integrations are unused, remove them; where they remain necessary, narrow trust policies and least-privilege permissions to reduce blast radius.
- End users and data owners: Be alert that opportunistic downloads can pull broad swaths of stored data; organizations should assume secrets and configuration values discovered in logs, environment variables, or parameter stores may have been exfiltrated and rotate secrets accordingly.
Remediation steps observed and recommended
- Search CloudTrail from October 1 forward for sessions initiated by Qubole’s AWS account and follow the chain to any Secrets Manager, SSM Parameter Store, Lambda environment, or S3 access.
- Rotate credentials and client secrets that may have been exposed, and revoke active role sessions tied to trusted third-party accounts.
- Remove unused integrations and restrict remaining cross-account roles’ permissions, trusted identities, and source networks to the minimum required.
- Audit logs and secrets storage for high-frequency exfil characteristics — Sentra’s timeline shows the attacker validated roughly 100 passwords and keys in seven minutes, underscoring how quickly credential harvesting can occur.
The incident reiterates a practical risk: the convenience of cross-account, third-party access can become a vector for widespread exposure if third-party credentials are compromised. Wiz, Sentra, and Mandiant have documented the attack pattern; Qubole has not publicly commented as of this report. Organizations that granted trust to the implicated account should treat that trust as potentially abused and proceed with immediate log review and credential rotation.
Source: BleepingComputer — Hackers exploit trusted AWS access to breach multiple cloud environments
