# Supply Chain Attack Exploits Qubole Trust to Breach AWS Customer Accounts Attackers abused cross-account IAM roles to harvest sensitive credentials and data from multiple organizations. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/ddc63814-fec0-46b3-af9e-c30facc4ec6f ## Supply Chain Compromise Between October 14 and October 26, attackers exploited compromised credentials linked to Qubole’s AWS account. By abusing cross-account IAM roles, intruders gained unauthorized access to multiple customer environments. This supply chain breach allowed attackers to bypass standard security perimeters by leveraging existing trust relationships between the data platform and clients. ## Exploitation Mechanism The attackers utilized the sts:AssumeRole API, originating from Qubole’s AWS account ID 805246085872. By providing the correct External ID, they successfully assumed integration roles. Researchers identified specific IAM user IDs, including AIDA3W7DIFLYOLTK63SFS, used to facilitate these requests. Many victims remained vulnerable because they kept trust policies active despite deprecating the platform. ## Data and Credential Theft Once inside, intruders systematically probed AWS services to harvest sensitive information. They extracted environment variables from Lambda functions, pulled secrets from Secrets Manager, and accessed the SSM Parameter Store. The attackers utilized TruffleHog to validate stolen AWS keys, Microsoft Entra ID secrets, and Okta client credentials found during the intrusion. ## Opportunistic S3 Exfiltration Beyond credential harvesting, the attackers performed bulk data exfiltration from S3 buckets. Rather than targeting specific files, they often downloaded entire buckets in single sessions. This behavior suggests an opportunistic approach, differing significantly from the targeted tactics typically employed by state-backed espionage groups seeking specific intelligence or high-value assets. ## Secondary Attack Campaign Wiz researchers identified a separate, earlier campaign occurring between October 8 and October 11. This activity involved the use of customer-owned AWS access keys specifically configured for Qubole integrations. While this resulted in several compromises, investigators have not definitively linked this earlier activity to the later cross-account role abuse. ## Detection and Investigation The malicious activity was initially flagged by Sentra and later analyzed by Wiz and Mandiant. Organizations are advised to audit CloudTrail logs starting from October 1. Specifically, security teams should search for AssumeRole requests from account 805246085872 that originated from non-AWS IP addresses to identify potential unauthorized session activity. ## Remediation Requirements Affected organizations must rotate all secrets, parameters, and Lambda environment variables accessible by the compromised roles. Simply rotating credentials does not terminate existing temporary sessions, so administrators must also revoke active sessions. Reviewing all subsequent activity within identified suspicious sessions is critical to understanding the full scope of the compromise. ## Security Implications This incident highlights the risks of maintaining legacy trust policies in cloud environments. Even when a platform is no longer in use, active IAM roles remain a viable entry point for attackers. Organizations must regularly audit third-party integrations and prune unused permissions to minimize the attack surface against supply chain threats. ## Sources covering this story - [www.theregister.com - Articles — Attackers Backdoor Trusted AWS Integrations to Steal Secrets](https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553) - [www.theregister.com - Articles (theregister.co.uk) — Attackers Backdoor Trusted AWS Integrations to Steal Secrets](https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553) - [The Hacker News — Hackers Exploit Qubole Access to Breach AWS Customer Accounts](https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html) - [www.theregister.com - Articles — Attackers Backdoor Trusted AWS Integrations to Steal Secrets](https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553) - [The Register — Attackers Backdoor Trusted AWS Integrations to Steal Secrets](https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._