Attacker used Qubole's trusted AWS access to breach customer accounts and steal data
Organizations that left unused Qubole cross-account roles in place were exposed, and the researchers have not yet said how the attacker obtained the credentials.
Between October 14 and October 26, an attacker used IAM credentials tied to Qubole's AWS account to assume cross-account roles that customers had left in place, reading data from more than a dozen organizations' environments, according to Wiz and Sentra. The roles were mostly unused but still trusted Qubole's account, so requests carrying the correct External ID were accepted. The intruder enumerated resources, pulled secrets from Secrets Manager, SSM Parameter Store and Lambda environment variables, validated them with TruffleHog, and downloaded objects from accessible S3 buckets. Sentra reported dozens of victims and millions of files taken from one customer alone. Qubole and its owner Idera had not published a statement when the reports were checked, and the researchers did not say how the credentials were obtained. Affected organizations should review CloudTrail logs from October 1, rotate exposed secrets, revoke active sessions and remove or narrow unused Qubole roles.
Why it matters
The breach shows that cross-account roles which are no longer in use can remain a live route into a customer's cloud environment after the vendor relationship has become dormant. For the organizations involved, the problem was not a flaw in their own accounts but a trust relationship they had forgotten about. Because the researchers did not say how the credentials were obtained, the reach of the campaign beyond the reported victims is still unclear.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.