Attackers used Qubole AWS credentials to raid customer clouds
From October 14 to 26 the actor assumed trusted roles, harvested secrets and downloaded S3 data from dozens of victims.
76
Vendor
Qubole
- Mentions · 7d8
- Mentions · 30d8
- All mentions8
- First seenNov 9, 2026
- Last mentioned7h ago
Timeline
8 articles · newest firstStolen Qubole AWS credentials used to take data from over a dozen firms
Dormant cross-account IAM roles were assumed from October 14 to October 26 to enumerate, harvest secrets, and download S3 data.
72
Attackers abuse trusted Qubole IAM roles to steal AWS secrets and S3 data
From October 14 to 26, 2026, attackers assumed customer roles via Qubole’s AWS account and sometimes downloaded entire buckets.
74
Attackers abused Qubole AWS trust to steal customer cloud data
From October 14 to October 26, attackers assumed customer roles, harvested secrets, and downloaded S3 data, including millions of files at one firm.
76
Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials
From October 14 to October 26, stolen Qubole AWS credentials let an attacker assume roles in dozens of customer accounts.
74
Attackers use Qubole AWS trust to steal customer secrets
Wiz says compromised Qubole IAM credentials let attackers AssumeRole into multiple customer AWS accounts starting October 14.
74
Attacker used Qubole AWS access to steal customer secrets and data
Between October 14 and October 26 the attacker assumed customer IAM roles and copied secrets and S3 data; how the credentials were obtained is undisclosed.
74
Qubole cross-account IAM roles abused in the wild
Threat actors abused Qubole's cross-account IAM trust to access multiple customer AWS environments, enumerating resources and exfiltrating data.
70
Appears with
- Wizorganization · 7
- Sentraorganization · 7
- Mandiantorganization · 5
- AWS IAMproduct · 5
- Amazon Web Servicesvendor · 4
- Amazon S3product · 4
- Amazonvendor · 3
- AWSproduct · 2
- Secrets Managerproduct · 2
- TruffleHogmalware · 2
- Googleorganization · 1
- TruffleHogproduct · 1
- Microsoftvendor · 1
- Ideravendor · 1
- customers using Qubolevictim · 1
- AWS Secrets Managerproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.