Amazon Web Services says its services were not compromised in the Qubole-linked cloud intrusion. AWS told The Register that attackers used credentials associated with a third-party provider to access customer accounts through IAM roles those customers had configured to trust the provider.
The attack was first detailed in a Wiz investigation published November 9. Working with Sentra and Google’s Mandiant, Wiz found that an attacker used credentials from an AWS account associated with Qubole to assume integration roles in multiple customer environments between October 14 and 26. The account, 805246085872, was used by Qubole’s platform to access customer environments, and the researchers traced activity to two IAM users in that account.
Once inside, the actor retrieved secrets from Lambda environment variables, AWS Secrets Manager and SSM Parameter Store, then used TruffleHog to validate credentials belonging to the affected organizations, including AWS keys, Microsoft Entra ID client secrets and Okta client credentials. The actor also copied data from accessible S3 buckets, in some cases downloading entire buckets in a single session, according to Wiz.
Wiz did not disclose a total victim count or explain how the Qubole-associated credentials were obtained. Sentra, which first spotted the activity, said it found the same pattern across more than a dozen Qubole-connected environments in its account of the investigation. The researchers also identified separate activity between October 8 and 11 involving customer-owned AWS access keys created for Qubole integrations, but said they could not link it to the main operation.
Qubole did not respond to The Register’s inquiries.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
