Wiz uncovers attacks abusing Qubole access to AWS accounts

Between 14 October and 26 October 2026, Wiz, Sentra and Mandiant say threat actors abused Qubole cross‑account access to breach multiple customer AWS environments. The intruder used compromised IAM credentials from Qubole’s vendor account (805246085872) to call sts:AssumeRole and assume trusted customer roles, enabling access to storage, compute and database services. Every AssumeRole request carried an External ID and, according to the researchers, every one succeeded.

The attacker used role session names such as quiam-enum and quiam-scope-full to map targets and privileges, and much of the activity stemmed from dormant Qubole cross‑account roles that remained enabled after customers stopped using the platform.

Credential harvesting and data theft followed. The attacker retrieved credentials from AWS Secrets Manager, SSM Parameter Store and Lambda function environment variables, then used TruffleHog to test stolen keys against AWS, Microsoft Entra ID and Okta. Wiz also identified a bootable Linux image named sso_agent.iso on the attacker’s OVH server, which loads ntfs3 to target Windows disks, runs scripts over TCP port 23458 and reboots after 90 minutes to erase traces.

Most victims reported that these Qubole roles had been inactive prior to the intrusion, yet trust policies allowed the attacks to succeed. The operation’s attribution remains unconfirmed; a handle “non” claimed responsibility, but investigators have not verified this.

Organisations are advised to remove unused or legacy third‑party IAM trust relationships, review CloudTrail for October 2026 AssumeRole activity from account 805246085872 outside AWS IP ranges and related AIDA3W7DIFLYOLTK63SFS activity, revoke active sessions and rotate secrets and Lambda variables accessed by the compromised Qubole roles.