Qubole supply chain attack exposed data at over a dozen firms

A threat actor used compromised AWS IAM credentials associated with big-data platform Qubole to access the cloud environments of more than a dozen organisations and steal data, according to cybersecurity firms Sentra and Wiz. The credentials let the attacker assume cross-account IAM roles that customers had created for Qubole. Sentra said some roles remained active even after customers stopped using the service, and could read much of the data targeted.

The campaign ran from 14 to 26 October. Sentra said the attacker used the roles to enumerate cloud resources, collect secrets and configurations, and access data. Activity came from a rented OVH server and the Mullvad VPN, rather than Qubole’s network. Wiz said the attacker used session names beginning “quiam-”, followed by labels such as “enum” or “scope-full”. After searching common AWS storage locations for secrets, the attacker used TruffleHog to test credentials and then copied data from victims’ S3 buckets.

Wiz described the theft as opportunistic: the attacker accessed whatever buckets the roles allowed, sometimes downloading entire buckets in a single session.

Wiz also found an ISO file intended to be remotely booted on victim machines to harvest data, but said it had no evidence the file was deployed. The firm said it had found no links to other publicly reported activity and could not determine the attacker’s motive or how stolen data might be used. It also identified a separate Qubole-integration campaign, active from 8 to 11 October, in which customer-owned AWS access keys were tested and, in some cases, used to compromise victim environments.