Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials
From October 14 to October 26, stolen Qubole AWS credentials let an attacker assume roles in dozens of customer accounts.
Researchers from Wiz, Sentra and Mandiant say an attacker used IAM credentials for Qubole’s AWS account to assume customer cross-account roles, including integrations that remained trusted after some organizations stopped using the platform. The intruder enumerated cloud resources, read secrets and downloaded Amazon S3 data, then tested AWS, Microsoft Entra ID and Okta credentials with TruffleHog. Sentra reported no write operations. The campaign is unattributed.
Unconfirmed: The campaign is unattributed, and Wiz could not confirm the ISO was used against victims.
- Activity ran from October 14 to October 26 using Qubole AWS account 805246085872.
- Sentra said dozens of customers were affected, including unused but still-trusted integrations.
- Wiz saw AssumeRole from Mullvad VPN and OVH VPS 57.129.54.120.
- Sentra reported more than 100 passwords and keys read within minutes.
- A Linux ISO named sso_agent.iso was hosted but not confirmed deployed.
Impact: Stolen S3 data plus AWS, Entra ID and Okta credentials
| Product | Affected |
|---|---|
| Qubole AWS integrations | — |
- 1.Review CloudTrail since October 1, 2026 for AssumeRole from Qubole account 805246085872.
- 2.Investigate Secrets Manager, Parameter Store, Lambda and S3 access after suspicious role assumption.
- 3.Remove unused third-party integrations and limit trust to specific vendor IAM principals.
- ATT&CK
- T1199 Trusted RelationshipT1078.004 Valid Accounts: Cloud AccountsT1580 Cloud Infrastructure DiscoveryT1530 Data from Cloud StorageT1552.001 Credentials In Files
From the original article
3 min read at csoonline.com
An attacker has abused AWS cross-account IAM roles to access multiple customer environments, steal data, and harvest credentials in a supply-chain attack that ran between October 14 and October 26. Researchers from Wiz, working with Sentra and Mandiant, said they observed an attacker using IAM credentials for Qubole’s AWS account to assume roles in customer environments.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.