Wiz Details Qubole-Linked AWS Cross-Account Access Abuse
Summary
Wiz reports a threat actor used IAM credentials associated with Qubole to access customer AWS environments, harvest and validate credentials, and exfiltrate S3 data. Wiz also describes a suspicious ISO image but has not identified any deployments.
Key points
- Wiz observed successful cross-account role assumptions from a Qubole-associated AWS account between October 14 and October 26, 2026.
- The actor enumerated customer cloud resources and accessed secrets in Lambda configuration, Secrets Manager, and SSM Parameter Store.
- The actor used TruffleHog to validate discovered AWS, Entra ID, and Okta credentials.
- Wiz reports the actor downloaded S3 objects, sometimes entire buckets; missing S3 data-event or access logging limited visibility in some environments.
- A separate October 8–11 activity set used customer-owned AWS keys believed to be for Qubole integrations; some cases involved further compromise, and Wiz could not link this activity to the role-assumption campaign.
- Wiz found an ISO image configured to collect system information and poll for scripts, but has not identified any deployment or confirmed its use.
- Wiz recommends reviewing CloudTrail, rotating exposed credentials, removing unused trust relationships, narrowing trusted principals and networks, and enabling S3 data logging for sensitive buckets.
Article Details
- Attack Vectors
- The actor used IAM credentials associated with Qubole's AWS account to assume customer-created cross-account roles that trusted the account.
- After assuming roles, the actor enumerated cloud resources and retrieved secrets from Secrets Manager, SSM Parameter Store, and Lambda environment variables.
- The actor accessed S3 objects and downloaded data from buckets reachable through the assumed roles.
- In separate activity that Wiz could not link to the role-assumption activity, an actor tested customer-owned AWS access keys believed to have been created for Qubole integrations; some of those cases led to victim cloud environments being compromised.
- An ISO hosted on an address used by the actor was described as collecting system information, uploading it, and polling over TCP for shell scripts. Wiz found no deployments and could not confirm whether or how the ISO was used.
- Defensive Notes
- Review CloudTrail from October 1, 2026 onward for the specified account and principal IDs, unexpected source addresses, and activity from the listed IPs; investigate role sessions and their subsequent activity.
- Rotate secrets, parameters, and Lambda environment-variable credentials readable by an assumed integration role, and revoke active role sessions. Credential rotation alone does not end already-issued temporary sessions.
- Remove unused integration roles or vendor trust, narrow trusted principals where supported, and restrict role assumption with documented source IP or VPC endpoint conditions.
- Treat External IDs as non-secret and do not rely on them as the only control; use distinct values per role where supported.
- Apply least privilege to integration roles and enable S3 data events or S3 server access logs for sensitive buckets to record object reads.
- Use organization-wide CloudTrail coverage across accounts and regions, and alert on third-party role assumptions from new or unexpected networks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 185[.]209[.]199[.]73 | Mullvad address used to assume integration roles across multiple victim environments; the article cautions that activity from shared VPN exits alone is not conclusive. |
| IPV4 | 45[.]83[.]220[.]211 | Mullvad VPN address used to assume roles in customer accounts; the article cautions that activity from shared VPN exits alone is not conclusive. |
| IPV4 | 57[.]129[.]54[.]120 | Address hosted by OVH that the article identifies as used for role assumption, enumeration, and credential harvesting; it also hosted the suspicious ISO. |
| IPV4 | 89[.]37[.]63[.]175 | Address used to assume roles within customer accounts, according to the article's IOC table. |
| IPV6 | 2001:41d0:70d:7800:: | Address identified in the article as used for credential enumeration and verification. |
| MD5 | 086d4a83181971e883c53a4c44f46da2 | MD5 of sso_agent.iso, an ISO hosted on an address used by the actor; Wiz could not confirm whether or how the ISO was deployed. |
| SHA1 | 1c7437dac21630f53c0b888b50662c6487e23fd7 | SHA-1 of sso_agent.iso, an ISO hosted on an address used by the actor; Wiz could not confirm whether or how the ISO was deployed. |
| SHA256 | 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 | SHA-256 of sso_agent.iso, an ISO hosted on an address used by the actor; Wiz could not confirm whether or how the ISO was deployed. |
MITRE ATT&CK
T1059.004 · Unix ShellThe suspicious ISO was described as polling an address for input and running received commands as shell scripts; Wiz could not confirm whether or how it was used.T1078.004 · Cloud AccountsThe actor used IAM credentials associated with a vendor AWS account to assume customer cross-account IAM roles.T1082 · System Information DiscoveryThe suspicious ISO was described as gathering system information, although Wiz identified no deployments and could not confirm its use.T1530 · Data from Cloud StorageThe actor enumerated S3 objects and used GetObject to download data from buckets accessible through assumed roles.T1555.006 · Cloud Secrets Management StoresThe actor retrieved secrets using Secrets Manager ListSecrets and GetSecretValue; Wiz also reports access to secrets in other AWS services.T1580 · Cloud Infrastructure DiscoveryAfter assuming roles, the actor enumerated AWS resources, including S3 buckets, compute instances, databases, and identity resources.
Vendors
Amazon Web Servicesenvironments. Working with Sentra and Mandiant, Wiz observed a threat actor using IAM credentials from an AWS account associated with Qubole between October 14 and October 26, 2026. The actor used these credentials toMullvad VPNThe first activity Wiz CIRT observed occurred on October 14, when an IP address belonging to Mullvad VPN (45.83.220[.]211) called AssumeRole against integration roles in customer environments. The calls originated fromOVHFrom October 15, most of the activity came from a VPS hosted by OVH (57.129.54[.]120). On October 18, the threat actor began using a second IAM user from the same account, AIDAJYRRH5Y3A7AAJM2HW, which also carriesQuboleand Mandiant, Wiz observed a threat actor using IAM credentials from an AWS account associated with Qubole between October 14 and October 26, 2026. The actor used these credentials to assume IAM roles that
Products
AWSenvironments. Working with Sentra and Mandiant, Wiz observed a threat actor using IAM credentials from an AWS account associated with Qubole between October 14 and October 26, 2026. The actor used these credentials toAWS LambdaLambda: the threat actor listed Lambda functions and called GetFunctionConfiguration on each, which returns function environment variables.CloudTrailTo detect this kind of exfiltration, organizations should make sure S3 data events in CloudTrail or S3 server access logs are enabled for buckets that hold sensitive data. CloudTrail management events record the roleEntra IDEntra ID: TruffleHog signed in as Entra ID service principals using discovered client secrets.OktaOkta: TruffleHog requested OAuth tokens using discovered Okta client credentials.S3AWS environments, the threat actor enumerated resources, collected configuration and secrets, accessed S3 data, and validated additional credentials it discovered along the way.Secrets ManagerSecrets Manager: ListSecrets followed by GetSecretValueSSM Parameter StoreSSM Parameter Store: DescribeParameters and GetParameter.