Over a Dozen Organizations Hit in Qubole Supply Chain Attack

What Happened

Security firms Sentra and Wiz disclosed a campaign in which a threat actor used compromised IAM credentials for an AWS account linked to Qubole, a big-data platform, to assume the cross-account IAM roles that customers had created for Qubole. That gave the attacker access to those customers' own AWS environments. More than a dozen organizations were affected.

Campaign Details

• Window: October 14 to October 26.
• Access method: assuming customer-created cross-account roles. Some of these roles had remained in place after companies stopped using Qubole, which one researcher described as "old ones."
• Actions: the attacker enumerated resources, harvested secrets from common AWS storage locations, validated credentials with TruffleHog, and exfiltrated data from S3 buckets. Wiz says the actor was opportunistic and sometimes downloaded entire buckets in a single session.
• Stolen data: customer files, secrets, keys, environment variables, and credentials.
• Infrastructure: activity came from a rented OVH server and the Mullvad VPN, not from Qubole's network.
• Other findings: Wiz found an ISO file designed to be booted remotely on victim machines but has no evidence it was deployed. A separate Qubole-related campaign from October 8 to 11 tested customer-owned AWS access keys against victim environments and, in some cases, used them for compromise.

Wiz found no ties to other publicly reported activity and no evidence of state-backed motivation.

Why It Matters

Third-party cross-account roles are a standing trust relationship. When a vendor's credentials are compromised, every customer that still trusts the vendor's account inherits the risk — even customers who no longer use the product.

Recommended Actions

The source article does not list formal mitigations; the following are general hardening steps consistent with the findings:

1. Audit IAM roles that trust external AWS account IDs, and remove any belonging to vendors you no longer use.
2. Require an External ID condition and scope role permissions to least privilege for vendor-assumed roles.
3. Review CloudTrail for AssumeRole calls from Qubole-associated accounts between October 8 and October 26, and for large S3 GetObject activity.
4. Rotate secrets and access keys stored in S3 buckets, environment variables, or configuration reachable by those roles.
5. Alert on access from unexpected networks such as commercial VPN and hosting-provider ranges.

Source

• SecurityWeek: Over a Dozen Organizations Hit in Qubole Supply Chain Attack