Stolen Qubole Credentials Opened Customer AWS Accounts
An attacker used credentials from an AWS account associated with data platform Qubole to enter customers’ AWS environments through roles they had granted the vendor. Wiz, Sentra and Mandiant investigated the campaign. Wiz observed activity from 14 to 26 October and published its findings on 9 November. It documented access to secrets and downloads from Amazon S3 in multiple customer environments. Wiz investigation · Sentra investigation
The old integration still worked
Customers had set up IAM roles that allowed Qubole’s AWS account to request temporary access. Several roles still trusted that account even though the integration had gone quiet. Wiz says the attacker supplied the required external ID in every request it attributed to the campaign. AWS then issued temporary credentials carrying the permissions of each role. The investigators established how the attacker entered customer accounts. The route by which the attacker first obtained the vendor-side credentials remains unclear. Wiz attack timeline · AWS guidance on third-party roles
Those permissions allowed the attacker to look for secrets in Lambda configuration, Secrets Manager and Systems Manager Parameter Store. The investigators also saw the attacker test newly discovered credentials and download S3 objects. A dormant integration can therefore remain a route to both stored data and credentials that work elsewhere. Wiz findings · Sentra’s data-access analysis
Trace the sessions and close unused access
Find the AWS accounts with active or retired Qubole integrations and inspect the corresponding role trust policies. Wiz recommends searching CloudTrail from 1 October for AssumeRole calls from the vendor account, then tracing what each suspect session did. Use the report’s identity, network and session-name indicators together. Some source addresses are shared VPN exits, so an address match alone cannot establish compromise. Review S3 object events where enabled and retain any other available access evidence before drawing conclusions about which files left. Wiz hunting guidance · AWS S3 logging guidance
Remove unused trust and block new sessions from suspect principals. If a role may have been used, revoke outstanding sessions as part of containment and rotate credentials the attacker accessed. Before restoring a needed integration, confirm the vendor identity and give the replacement role access only to the resources it needs. AWS session revocation guidance · Sentra containment guidance
