Qubole AWS Credentials Used to Steal Data From More Than a Dozen Organizations
Summary
Researchers say stolen Qubole AWS credentials let an actor assume dormant customer IAM roles and exfiltrate data from more than a dozen organizations between Oct. 14 and 26. A separate campaign tested customer-owned keys.
Key points
- Sentra and Wiz say compromised credentials for a Qubole-associated AWS account let the actor assume customer cross-account IAM roles, including dormant roles left in place after Qubole use ended.
- The roles were used from October 14 to 26 to enumerate AWS resources, collect secrets and configurations, and access data.
- Researchers say the actor harvested secrets from AWS storage locations, tested credentials with TruffleHog, and exfiltrated data from victims’ S3 buckets; some buckets were reportedly downloaded in full.
- Sentra and Wiz report that observed activity came from a rented OVH server and Mullvad VPN, not Qubole’s network.
- Wiz found an ISO file designed to boot remotely and harvest data from victim machines, but reported no evidence that it was deployed.
- Wiz also identified a separate campaign from October 8 to 11 that tested customer-owned AWS access keys and, in some cases, used them to compromise victim environments.
- Wiz described the targeting as apparently opportunistic but said it had no direct insight into the actor’s motivation or use of the stolen data.
Article Details
- Victim Organization
- Not disclosed; over a dozen organizations were affected
- Victim Domain
- Not disclosed
- Incident Type
- Qubole supply-chain credential compromise enabling cross-account access to customer AWS environments and data theft. A separate Qubole-integration campaign from October 8 to October 11 tested customer-owned AWS access keys and reportedly compromised some environments.
- Data Types Exposed
- Data from victims’ S3 buckets; specific data types not identified
- Secrets and configurations were collected
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Attackers used compromised Qubole AWS credentials to assume customer-configured IAM roles, enumerate resources, collect secrets and configurations, and exfiltrate data from victims’ S3 buckets. The reported activity took place from October 14 to October 26; the year is not specified. Researchers also identified an ISO file designed for remote booting to harvest data, but reported no evidence it was deployed.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Vendors
Amazon Web ServicesA threat actor used the compromised IAM credentials for an AWS account associated with big-data platform Qubole to steal data from over a dozen organizations, cybersecurity researchers discovered.QuboleA threat actor used the compromised IAM credentials for an AWS account associated with big-data platform Qubole to steal data from over a dozen organizations, cybersecurity researchers discovered.
Products
AWSA threat actor used the compromised IAM credentials for an AWS account associated with big-data platform Qubole to steal data from over a dozen organizations, cybersecurity researchers discovered.QuboleA threat actor used the compromised IAM credentials for an AWS account associated with big-data platform Qubole to steal data from over a dozen organizations, cybersecurity researchers discovered.S3Next, the threat actor exfiltrated data from the victims’ S3 buckets.