Attackers Abuse Trusted Qubole Link to Raid Customers' AWS Environments

Researchers at Wiz have uncovered a supply-chain attack in which unknown attackers used compromised identity and access management (IAM) credentials linked to Qubole's AWS account to reach customer AWS environments. Qubole is a cloud data processing platform that uses cross-account roles to manage compute and storage in customers' accounts, so customers do not need to hand over long-lived access keys. The attackers abused that trusted relationship to steal secrets and other sensitive data from S3 buckets.

Wiz, working with Google's Mandiant incident responders after AI data security company Sentra flagged suspicious activity, traced the activity back to October 14. Wiz described it as a broad, opportunistic campaign that hit multiple customer environments, but would not say how many organisations were affected. Researchers said many organisations left trust policies active even after they stopped using the platform, which let the attacker assume integration roles, list cloud resources, harvest secrets and siphon data. Neither AWS nor Qubole responded to The Register's inquiries.

Once inside, the attackers probed many AWS services and stole credentials, keys and other secrets stored in Lambda, Secrets Manager and SSM Parameter Store. They also used the TruffleHog tool to test stolen AWS credentials, find Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials found along the way.