Attackers abused Qubole AWS trust to steal customer cloud data
Original title: Hackers Abuse Qubole’s Trusted AWS Access to Breach Multiple Cloud Accounts and Steal Sensitive Data
From October 14 to October 26, attackers assumed customer roles, harvested secrets, and downloaded S3 data, including millions of files at one firm.
Attackers used AWS credentials tied to Qubole to assume customer IAM roles and steal secrets and S3 data between October 14 and October 26, 2026. Sentra said more than a dozen organizations were hacked and described impact across dozens of Qubole customers. Wiz traced activity to AWS account 805246085872 and later a second principal that also appeared in legitimate Qubole traffic. Wiz, Sentra and Mandiant investigated; Wiz did not attribute the campaign to a known group.
Unconfirmed: Wiz could not link the October 8-11 key abuse to the role-assumption campaign or attribute the operation to a known group.
- Separate customer-owned AWS key abuse ran from October 8 to October 11.
- Sentra reported millions of downloaded files in one affected company's accounts.
- Attackers read Lambda, Secrets Manager, Parameter Store and EC2 user data, then used TruffleHog.
- Primary infrastructure included an OVH host and Mullvad VPN addresses.
- Wiz found sso_agent.iso on the OVH address but no confirmed deployments.
Impact: Cloud secrets and sensitive S3 data stolen from customer accounts
| Product | Affected |
|---|---|
| Qubole Trusted AWS Access cross-account IAM roles | — |
- 1.Review CloudTrail from October 1 for the named principals, source networks, and later secret or storage access.
- 2.Enable S3 data events or server access logging on sensitive buckets to confirm object-level theft.
- 3.Remove unused vendor trust, restrict permissions and networks, rotate exposed secrets, and revoke sessions.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1552.001 Unsecured Credentials: Credentials In FilesT1580 Cloud Infrastructure DiscoveryT1530 Data from Cloud Storage
- Vendors
- QuboleAmazon Web Services
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.209.199.73 | cipal, AIDAJYRRH5Y3A7AAJM2HW , and another Mullvad address, 185.209.199[.]73 . Unlike the first principal, the second also appeared in |
| ipv4 | 45.83.220.211 | SFS . On October 14, requests came from Mullvad VPN address 45.83.220[.]211 ; subsequent activity primarily used OVH-hosted infrastru |
| ipv4 | 57.129.54.120 | equent activity primarily used OVH-hosted infrastructure at 57.129.54[.]120 . On October 18, the attacker began using a second princi |
From the original article
3 min read at gbhackers.com
Hackers abused AWS credentials associated with Qubole to breach multiple customer cloud environments, harvest secrets, and steal sensitive S3 data between October 14 and October 26, 2026. Sentra reported that more than a dozen organizations were hacked, describing the broader impact as involving dozens of Qubole customers. Some compromised integration roles had remained dormant for […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.