Executive Summary
Between October 14 and October 26, unidentified threat actors targeted AWS accounts belonging to multiple Qubole customers by leveraging compromised credentials associated with Qubole’s service platform. The attackers utilized the platform's trusted cross-account IAM roles to gain unauthorized access to customer environments. By exploiting the inherent trust between Qubole’s AWS account and its clients, the actors were able to bypass typical security barriers.
Technically, the actor performed AWS AssumeRole requests using the legitimate Qubole account ID (805246085872) combined with the necessary External IDs. Once inside the victim accounts, they conducted extensive credential harvesting by reading environment variables in Lambda functions, accessing AWS Secrets Manager, and querying the SSM Parameter Store. Stolen credentials were then validated using the TruffleHog tool. Furthermore, the attackers engaged in bulk data exfiltration from S3 buckets.
This campaign highlights the significant risks associated with third-party cloud integrations and 'over-privileged' vendor roles. Organizations that have ever connected Qubole to their AWS environment are at risk, even if the service is no longer actively used, as dormant IAM roles often remained trusted. The business impact includes the potential compromise of secondary credentials (Okta, Entra ID) and the loss of proprietary data stored in S3.