Attacker used Qubole AWS access to steal customer secrets and data
Original title: Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
Between October 14 and October 26 the attacker assumed customer IAM roles and copied secrets and S3 data; how the credentials were obtained is undisclosed.
Wiz said an attacker used credentials for the AWS account Qubole's platform uses, 805246085872, to AssumeRole into multiple customers' accounts between October 14 and October 26. The attacker read Lambda environment variables, Secrets Manager, and SSM Parameter Store, tested credentials with TruffleHog, and copied S3 data. A separate October 8–11 use of customers' own AWS access keys has not been linked. Neither Qubole nor Idera had posted a statement when The Hacker News checked.
Unconfirmed: How the attacker obtained Qubole's credentials, and whether they were disabled, has not been disclosed.
- Look for AssumeRole from account 805246085872 with a source IP outside AWS, in CloudTrail from October 1.
- Attacker IAM principal IDs include AIDA3W7DIFLYOLTK63SFS and, from outside AWS, AIDAJYRRH5Y3A7AAJM2HW.
- Stolen material included AWS access keys, Entra ID client secrets, and Okta client credentials.
- Researchers said a source IP condition alone would have blocked every observed role assumption.
Impact: customer secrets, identity credentials, and S3 data copied
| Product | Affected |
|---|---|
| Qubole | — |
- 1.Review CloudTrail from October 1 for AssumeRole from 805246085872 sourced outside AWS.
- 2.If a Qubole role was assumed, rotate secrets it could reach and revoke active sessions.
- 3.Remove unused Qubole roles or drop Qubole's account from the trust policy.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1552 Unsecured CredentialsT1530 Data from Cloud Storage
- Products
- AWS IAMSecrets ManagerTruffleHog
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.209.199.73 | sted addresses that the attacker used. IP: 45.83.220[.]211, 185.209.199[.]73 and 89.37.63[.]175, which are Mullvad VPN addresses. Othe |
| ipv4 | 45.83.220.211 | [:]7800::, OVH-hosted addresses that the attacker used. IP: 45.83.220[.]211, 185.209.199[.]73 and 89.37.63[.]175, which are Mullvad V |
| ipv4 | 57.129.54.120 | m October 18, but Qubole's normal traffic also uses it. IP: 57.129.54[.]120 and 2001:41d0:70d[:]7800::, OVH-hosted addresses that the |
| ipv4 | 89.37.63.175 | he attacker used. IP: 45.83.220[.]211, 185.209.199[.]73 and 89.37.63[.]175, which are Mullvad VPN addresses. Other VPN users share t |
From the original article
5 min read at thehackernews.com
An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26 and stole stored secrets and data, cloud security company Wiz said today. The attacker used credentials for an AWS account that Qubole's platform uses to reach those customers. How the attacker got those credentials has not been disclosed.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.