Stolen Qubole AWS credentials used to take data from over a dozen firms
Original title: Over a Dozen Organizations Hit in Qubole Supply Chain Attack
Dormant cross-account IAM roles were assumed from October 14 to October 26 to enumerate, harvest secrets, and download S3 data.
Sentra and Wiz say a threat actor used compromised IAM credentials for an AWS account tied to Qubole to assume customer roles and steal data from more than a dozen organizations. Many roles remained after companies stopped using Qubole and could read nearly all targeted data. Activity from October 14 to October 26 came from a rented OVH server and Mullvad VPN, not Qubole’s network, the researchers say. A separate campaign from October 8 to October 11 tested customer-owned AWS access keys.
Unconfirmed: Wiz says motivation is unknown, sees no link to other reported activity, and has no evidence the ISO was deployed.
- Session names used a quiam- prefix, including quiam-enum and quiam-scope-full.
- Attackers harvested secrets from common AWS storage locations and tested them with TruffleHog.
- Wiz says entire S3 buckets were sometimes downloaded in one session.
- Wiz found an ISO for remote boot and data harvesting but no evidence it was deployed.
Impact: Customer AWS data read through assumed Qubole IAM roles
- 1.Remove unused Qubole cross-account IAM roles that can still read data.
- 2.Review logs for quiam- role session names between October 14 and October 26.
- 3.Rotate secrets stored in AWS locations those roles could reach.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1580 Cloud Infrastructure DiscoveryT1530 Data from Cloud Storage
- Vendors
- QuboleAmazon Web Services
From the original article
2 min read at securityweek.com
Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials. The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.