Compromised Qubole AWS Credentials Used to Access Customer Environments
Summary
Wiz reports an attacker used compromised Qubole IAM credentials to access dozens of customers’ AWS environments and download S3 data. Sentra confirmed millions of files stolen from one customer; the initial compromise method and total victim count remain unspecified.
Key points
- Wiz found that an attacker compromised two Qubole IAM users and assumed roles in customer AWS accounts configured to trust Qubole.
- From October 14 to 26, the attacker accessed cloud resources, retrieved secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables.
- The attacker used TruffleHog to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.
- Wiz says the attacker enumerated accessible S3 buckets and downloaded their data; Sentra confirmed millions of files stolen from one customer and dozens of victims.
- Sentra reported the attacker collected passwords and keys at a rate of 100 in seven minutes. The report does not specify how the Qubole accounts were initially compromised or the exact number of downstream victims.
- Administrators are advised to review CloudTrail from October 1 onward, investigate suspicious secret and S3 access, rotate exposed credentials, revoke active role sessions, and restrict or remove integrations.
Article Details
- Victim Organization
- Qubole and multiple customer organizations with AWS environments configured to trust Qubole's AWS account
- Victim Domain
- Unknown
- Incident Type
- Compromise of Qubole IAM credentials, unauthorized cross-account access to customers' AWS environments, and data exfiltration
- Incident Date
- 2026-10-14
- Data Types Exposed
- Data stored in accessible S3 buckets; specific contents not disclosed
- Secrets retrieved from AWS Secrets Manager and SSM Parameter Store
- Lambda environment variables
- AWS keys, Microsoft Entra ID client secrets, and Okta client credentials were discovered and validated
- Affected Records
- Dozens of customer organizations, according to Sentra; the exact number is not specified.
- Affected Data Size
- Sentra reported that millions of files were stolen from one customer alone; total volume is not specified.
- Operational Impact
- Unauthorized access to multiple customers' AWS environments and data exfiltration. The campaign ran from 2026-10-14 through 2026-10-26. No service disruption is reported.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
T1078.004 · Cloud AccountsThe attacker used compromised Qubole IAM credentials to assume customer AWS roles.T1526 · Cloud Service DiscoveryThe attacker surveyed cloud resources after assuming roles in customer AWS accounts.T1530 · Data from Cloud StorageThe attacker enumerated and downloaded data from accessible S3 buckets.
Vendors
Amazon Web ServicesHackers exploit trusted AWS access to breach multiple cloud environmentsMandiantThe investigation also included cybersecurity company Mandiant.QuboleA threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.SentraWiz started to investigate the attack after data security and governance company Sentra shared information about suspicious activity observed in some of its customers' environments.WizResearchers at cloud security company Wiz explain that external providers use AWS’s STS AssumeRole API to obtain temporary credentials for accessing customers' resources in the cloud.
Products
AWSHackers exploit trusted AWS access to breach multiple cloud environmentsAWS LambdaWiz says the attacker then surveyed cloud resources, retrieved secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables.AWS Secrets ManagerWiz says the attacker then surveyed cloud resources, retrieved secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables.CloudTrailPotentially impacted administrators are advised to review CloudTrail from October 1 onward for suspicious access from Qubole’s AWS account, investigate subsequent secret and S3 access, rotate exposed credentials, andIAMA threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.Microsoft Entra IDThey then used the TruffleHog tool to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.OktaThey then used the TruffleHog tool to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.QuboleA threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.S3Once they gained deeper access, they downloaded data from all accessible S3 buckets in the AWS environment, following an opportunistic approach rather than carefully targeting specific data.SSM Parameter StoreWiz says the attacker then surveyed cloud resources, retrieved secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables.