Supply Chain Attack Exploits Qubole Trust to Breach AWS Customer Accounts
Attackers abused cross-account IAM roles to harvest sensitive credentials and data from multiple organizations.
1Supply Chain Compromise
Between October 14 and October 26, attackers exploited compromised credentials linked to Qubole’s AWS account. By abusing cross-account IAM roles, intruders gained unauthorized access to multiple customer environments. This supply chain breach allowed attackers to bypass standard security perimeters by leveraging existing trust relationships between the data platform and clients.
2Exploitation Mechanism
The attackers utilized the sts:AssumeRole API, originating from Qubole’s AWS account ID 805246085872. By providing the correct External ID, they successfully assumed integration roles. Researchers identified specific IAM user IDs, including AIDA3W7DIFLYOLTK63SFS, used to facilitate these requests. Many victims remained vulnerable because they kept trust policies active despite deprecating the platform.
3Data and Credential Theft
Once inside, intruders systematically probed AWS services to harvest sensitive information. They extracted environment variables from Lambda functions, pulled secrets from Secrets Manager, and accessed the SSM Parameter Store. The attackers utilized TruffleHog to validate stolen AWS keys, Microsoft Entra ID secrets, and Okta client credentials found during the intrusion.
4Opportunistic S3 Exfiltration
Beyond credential harvesting, the attackers performed bulk data exfiltration from S3 buckets. Rather than targeting specific files, they often downloaded entire buckets in single sessions. This behavior suggests an opportunistic approach, differing significantly from the targeted tactics typically employed by state-backed espionage groups seeking specific intelligence or high-value assets.
5Secondary Attack Campaign
Wiz researchers identified a separate, earlier campaign occurring between October 8 and October 11. This activity involved the use of customer-owned AWS access keys specifically configured for Qubole integrations. While this resulted in several compromises, investigators have not definitively linked this earlier activity to the later cross-account role abuse.
6Detection and Investigation
The malicious activity was initially flagged by Sentra and later analyzed by Wiz and Mandiant. Organizations are advised to audit CloudTrail logs starting from October 1. Specifically, security teams should search for AssumeRole requests from account 805246085872 that originated from non-AWS IP addresses to identify potential unauthorized session activity.
7Remediation Requirements
Affected organizations must rotate all secrets, parameters, and Lambda environment variables accessible by the compromised roles. Simply rotating credentials does not terminate existing temporary sessions, so administrators must also revoke active sessions. Reviewing all subsequent activity within identified suspicious sessions is critical to understanding the full scope of the compromise.
8Security Implications
This incident highlights the risks of maintaining legacy trust policies in cloud environments. Even when a platform is no longer in use, active IAM roles remain a viable entry point for attackers. Organizations must regularly audit third-party integrations and prune unused permissions to minimize the attack surface against supply chain threats.