Attackers abuse trusted Qubole IAM roles to steal AWS secrets and S3 data
Original title: Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets
From October 14 to 26, 2026, attackers assumed customer roles via Qubole’s AWS account and sometimes downloaded entire buckets.
Researchers from Wiz, working with Sentra and Mandiant, say attackers used cross-account IAM roles customers had granted to Qubole, not a software vulnerability. Activity ran October 14–26, 2026, often against unused roles whose trust policies still accepted the vendor account. After mapping cloud resources, the attacker read Lambda environment variables, Secrets Manager values, and SSM Parameter Store entries, validated credentials with TruffleHog, and downloaded reachable S3 objects. Neither the attacker’s identity nor plans for the data were established.
Unconfirmed: Wiz could not confirm deployment of the malicious Linux image or link October 8–11 key abuse to this campaign.
- Wiz says review CloudTrail from October 1, 2026, for Qubole role assumptions.
- Primary infrastructure included OVH address 57.129.54.120 and AWS account 805246085872.
- A malicious bootable image, sso_agent.iso, was found but not confirmed in use.
- Separate customer-owned key abuse on October 8–11 was not linked to this campaign.
- External IDs were present on every attacker role-assumption request and all succeeded.
Impact: Cloud secrets stolen and S3 bucket data downloaded
| Product | Affected |
|---|---|
| Qubole IAM integration roles | — |
| Amazon AWS customer accounts using Qubole roles | — |
- 1.Review CloudTrail from October 1, 2026, for Qubole role assumptions from unexpected networks.
- 2.If a role was abused, revoke active sessions and rotate accessible secrets and credentials.
- 3.Enable S3 data events or server access logs on sensitive buckets.
- ATT&CK
- T1078.004 Cloud AccountsT1580 Cloud Infrastructure DiscoveryT1552 Unsecured CredentialsT1530 Data from Cloud Storage
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.209.199.73 | n IPv4 45.83.220[.]211 Mullvad role-assumption traffic IPv4 185.209.199[.]73 Mullvad role-assumption traffic IPv4 89.37.63[.]175 VPN r |
| ipv4 | 45.83.220.211 | 0:70d[:]7800:: Credential enumeration and verification IPv4 45.83.220[.]211 Mullvad role-assumption traffic IPv4 185.209.199[.]73 Mul |
| ipv4 | 57.129.54.120 | romise (IoCs):- Type Source-reported indicator Context IPv4 57.129.54[.]120 Primary OVH infrastructure; October 15–26 IPv6 2001:41d0: |
| ipv4 | 89.37.63.175 | IPv4 185.209.199[.]73 Mullvad role-assumption traffic IPv4 89.37.63[.]175 VPN role-assumption traffic AWS account 805246085872 Also |
| md5 | 086d4a83181971e883c53a4c44f46da2 | alicious Linux image TCP port 23458 ISO command polling MD5 086d4a83181971e883c53a4c44f46da2 ISO hash SHA-1 1c7437dac21630f53c0b888b50662c6487e23fd7 ISO |
| sha1 | 1c7437dac21630f53c0b888b50662c6487e23fd7 | polling MD5 086d4a83181971e883c53a4c44f46da2 ISO hash SHA-1 1c7437dac21630f53c0b888b50662c6487e23fd7 ISO hash SHA-256 65f061281c9a712e9502793dc4c5035cae490b84da |
| sha256 | 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 | 1 1c7437dac21630f53c0b888b50662c6487e23fd7 ISO hash SHA-256 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 ISO hash Note: IP addresses and domains are intentionally Q |
From the original article
4 min read at cybersecuritynews.com
Hackers abused trusted Qubole integrations to enter customer AWS accounts, steal secrets, and download data from Amazon S3, sometimes taking entire buckets in one session. The activity ran from October 14 through October 26, 2026, using IAM credentials from an AWS account associated with Qubole rather than exploiting a software vulnerability. The attackers relied on […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.