Trusted by Default: Qubole Cross-Account Access Abused in the Wild
Researchers observed a threat actor abusing Qubole cross-account IAM trust relationships in AWS environments between October 14 and October 26, 2026. The attacker assumed customer-created integration roles, enumerated cloud resources, exfiltrated S3 data, and used TruffleHog to validate credentials discovered in Lambda functions, Secrets Manager, and SSM Parameter Store. Wiz, Sentra, and Mandiant tracked the campaign, noting that threat actors leveraged shared VPNs and virtual private servers to execute the role assumptions. Open article →
- Attackers backdoor trusted AWS integrations to steal secrets
- Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
- Attacker Uses Qubole Access to Raid Customer AWS Accounts
- Inside the Qubole Supply Chain Attack: How Sentra Found It
- If You Ever Connected Qubole to AWS, Check CloudTrail From October 1. Someone Used Qubole's Own AWS Account to Assume Customer Roles and Read Secrets and S3 Data
- TRUSTED BY DEFAULT 🔑 Third-party integrations make cloud life easier until they become a backdoo...
- Supply chain attack on Qubole customers
- ‼️ Attackers breached multiple Qubole customers' AWS accounts using credentials for Qubole's trus...