Attackers used Qubole's AWS account to steal data from its customers

An attacker used credentials from an AWS account belonging to data platform Qubole to get into its customers' cloud environments, harvest secrets and download data, cloud security firm Wiz reported on Monday. The activity ran from October 14 to October 26. Data security company Sentra noticed it first across several of its own customers and recognised it as a supply chain attack; Mandiant also worked on the investigation.

Qubole, like many data platforms, works inside customers' AWS accounts through cross-account roles: the customer creates a role that trusts Qubole's AWS account, usually gated by an External ID. According to Wiz, the attacker used two IAM users in the AWS account Qubole's platform uses, 805246085872, to assume those customer roles. Every request carried an External ID and every one succeeded. Most of the roles were otherwise idle, and in most of the environments Wiz saw, the attacker's requests were the only use of the vendor account that month.

What the attacker did inside

Once in, the attacker listed storage, compute, database and key resources, read Lambda function settings, pulled values from Secrets Manager and SSM Parameter Store, and then downloaded from whatever S3 buckets each role could reach, in some cases whole buckets in a single session. It ran the secret-scanning tool TruffleHog to check the credentials it found, including AWS access keys, Entra ID service principal secrets and Okta client credentials belonging to the victims.

The traffic came from Mullvad VPN addresses and a server at OVH, not from AWS, where all of Qubole's legitimate traffic originated. Wiz also found a bootable Linux image, sso_agent.iso, on that OVH server, built to report a machine's disks to the attacker and run commands for 90 minutes before rebooting; it has not seen it used. Separately, someone tested customer-owned AWS keys apparently made for Qubole integrations between October 8 and 11, but Wiz could not link that to this campaign.

What Qubole customers should check

Wiz advises reviewing CloudTrail from October 1 in every account with a Qubole integration role for AssumeRole calls from account 805246085872 that did not come from AWS addresses, for the IAM principal AIDA3W7DIFLYOLTK63SFS, and for role session names starting with quiam-. Anyone whose role was assumed should rotate every secret, parameter and Lambda variable the role could read and revoke its active sessions. Wiz says a condition limiting role assumption to the vendor's network ranges would have blocked every attempt it saw, and that integrations no longer in use should be removed.

What is not known

Qubole has not published a statement, and Wiz, which called it an active campaign, does not say how the attacker obtained the IAM credentials, how many customers were affected or who is behind the campaign. Wiz says the theft looks opportunistic rather than state-backed and has found no link to other reported activity.