Wiz details attacker breach of Qubole linked AWS accounts

Wiz researchers said an attacker breached multiple Qubole customer AWS environments between 14 and 26 October 2026 by using credentials tied to the Qubole platform’s access to those customers’ AWS accounts. The intruder leveraged a Qubole-managed AWS account to assume IAM roles in the customers’ accounts. Each AssumeRole request included a matching External ID, and AWS accepted the requests even though most roles were unused, because they still trusted Qubole’s account.

The attacker accessed stored credentials, including environment variables for Lambda functions, Secrets Manager values and SSM Parameter Store data, and then used those credentials to fetch data from S3. In some cases, an attacker used customers’ own AWS access keys—set up for Qubole—during October 8–11 to compromise a subset of environments.

The findings come from Wiz’s technical analysis and alerts from Sentra. Wiz indicates that, in the observed activity, the attacker did not exclusively target specific data types and instead sought broadly whatever buckets and credentials were accessible through the compromised roles. In addition to the AssumeRole abuse, the attacker reportedly copied data out of S3 and, in some instances, downloaded entire buckets in a single session.

Wiz notes that CloudTrail management events show AssumeRole and bucket-listing activity, but not the specific S3 objects read; several victims lacked detailed logs to determine exact object reads.

Public guidance from Wiz urges organisations with any Qubole role connected to AWS to review CloudTrail logs from 1 October 2026 onward for signs of AssumeRole from 805246085872 with non-AWS source IPs, and to scrutinise the IAM principals and IPs listed in their investigations. The researchers also recommend rotating secrets and removing unused Qubole roles, and applying tighter trust policies and source IP controls to block unauthorised role assumptions. Qubole and Idera had not issued a public statement at the time of reporting.