Qubole cross-account IAM roles abused in the wild
Original title: Trusted by Default: Qubole Cross-Account Access Abused in the Wild
Threat actors abused Qubole's cross-account IAM trust to access multiple customer AWS environments, enumerating resources and exfiltrating data.
Wiz observed threat actors using Qubole-associated AWS accounts to assume IAM roles in customer environments between October 14 and October 26, 2026. The actors enumerated resources, harvested credentials using tools like TruffleHog, and exfiltrated S3 data. The activity was identified as a supply chain attack on third-party integrations.
Unconfirmed: The exact threat actor identity is not confirmed.
- Assumes roles with External ID from Mullvad and OVH IPs
- Used multiple IAM users and session names starting with quiam-
- Exfiltrated S3 data opportunistically from buckets reachable by assumed roles
Impact: unauthorized access to AWS environments
- 1.Audit IAM roles and trust policies
- 2.Revoke unused roles
- 3.Monitor for unusual AssumeRole calls
- Products
- AWS
- Victims
- customers using Qubole
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 185.209.199.73 | WS infrastructure. The same day, a second Mullvad address ( 185.209.199[.]73 ) assumed integration roles across multiple victim enviro |
| ipv4 | 45.83.220.211 | n October 14, when an IP address belonging to Mullvad VPN ( 45.83.220[.]211 ) called AssumeRole against integration roles in customer |
| ipv4 | 57.129.54.120 | er 15, most of the activity came from a VPS hosted by OVH ( 57.129.54[.]120 ). On October 18, the threat actor began using a second I |
| ipv4 | 89.37.63.175 | 8 2026-10-21 Used to assume roles within customer accounts. 89.37.63[.]175 Datacamp Limited (Registered to Mullvlad VPN AB) 2026-10- |
| md5 | 086d4a83181971e883c53a4c44f46da2 | his post. Host Indicators File Name Hash sso_agent.iso MD5: 086d4a83181971e883c53a4c44f46da2 SHA-1: 1c7437dac21630f53c0b888b50662c6487e23fd7 SHA-256: 65 |
| sha1 | 1c7437dac21630f53c0b888b50662c6487e23fd7 | sso_agent.iso MD5: 086d4a83181971e883c53a4c44f46da2 SHA-1: 1c7437dac21630f53c0b888b50662c6487e23fd7 SHA-256: 65f061281c9a712e9502793dc4c5035cae490b84da05f7d422 |
| sha256 | 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 | led by the threat actor. This file, sso_agent.iso, (SHA-256 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 ) is a bootable linux image that we believe is designed to |
From the original article
9 min read at wiz.io
A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it.
By Zack Morrow · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.