Attackers used credentials associated with an AWS account that Qubole, a cloud data-processing platform, uses to access customer environments, allowing them to assume customer roles, steal secrets and download data from S3 buckets. Wiz said it observed the activity across multiple customer environments between October 14 and October 26, 2026, in an investigation conducted with Sentra and Google’s Mandiant.
The access relied on cross-account IAM roles that customers had created to let Qubole operate inside their AWS accounts. The attacker supplied the External ID required by each role when calling AWS’s AssumeRole service, and Wiz said every request it attributed to the campaign succeeded. Many of the roles were no longer in use; in most affected environments, the attacker’s requests were the only AssumeRole activity from Qubole’s account during October. The risk of forgotten third-party access also appeared in the Klue breach linked to an old integration credential and the Cloudflare breach tied to a compromised third-party integration, although the access methods differed.
After entering the accounts, the attacker enumerated AWS resources and collected secrets from Lambda function environment variables, Secrets Manager and SSM Parameter Store. Wiz said the actor used TruffleHog to validate credentials belonging to affected organizations, including AWS keys, Microsoft Entra ID service-principal secrets and Okta client credentials. The attacker also copied data from S3 buckets, sometimes downloading entire buckets in a single session.
The researchers did not identify how the Qubole-linked credentials were obtained, name the affected organizations or quantify the stolen data. They also did not attribute the campaign to a known group or determine how the stolen information was used. The Register reported that Qubole and AWS did not respond to its requests for comment.
Wiz also identified separate activity from October 8 to October 11 involving customer-owned AWS access keys created for Qubole integrations. A small number of those cases led to compromises, but Wiz said it could not connect that activity to the later campaign.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
