Attackers used Qubole AWS credentials to raid customer clouds
Original title: Hackers exploit trusted AWS access to breach multiple cloud environments
From October 14 to 26 the actor assumed trusted roles, harvested secrets and downloaded S3 data from dozens of victims.
A threat actor used two compromised IAM users on a Qubole AWS account to assume customer roles that trusted that account, then stole data. Wiz, after a tip from Sentra and with Mandiant involved, found the attacker surveyed resources, read secrets and Lambda variables, validated keys with TruffleHog, and downloaded every reachable S3 object. Sentra confirmed dozens of victims and millions of files from one customer. Qubole has made no public announcement.
Unconfirmed: The exact compromise method and the number of downstream victims are not stated; Sentra reports dozens of victims.
- The activity ran from October 14 through October 26.
- Sentra says secrets were collected at about 100 passwords and keys in seven minutes.
- The method used to compromise the Qubole IAM users is not described.
- Administrators are told to review CloudTrail from October 1 for Qubole account access.
Impact: Secrets and S3 data stolen via trusted IAM roles
| Product | Affected |
|---|---|
| Qubole AWS cross-account IAM integration | — |
- 1.Review CloudTrail from October 1 for access from Qubole’s AWS account.
- 2.Rotate exposed credentials and revoke active role sessions.
- 3.Remove unused integrations and restrict remaining role trust and permissions.
- ATT&CK
- T1199 Trusted RelationshipT1078.004 Cloud AccountsT1580 Cloud Infrastructure DiscoveryT1530 Data from Cloud Storage Object
- Vendors
- QuboleAmazon Web Services
- Malware
- TruffleHog
From the original article
2 min read at bleepingcomputer.com
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.