Attackers use Qubole AWS trust to steal customer secrets
Original title: Attackers backdoor trusted AWS integrations to steal secrets
Wiz says compromised Qubole IAM credentials let attackers AssumeRole into multiple customer AWS accounts starting October 14.
Wiz said unknown attackers used compromised IAM credentials tied to Qubole's AWS account to assume customer integration roles and steal secrets and S3 data. Activity began October 14 with sts:AssumeRole calls from account 805246085872 and continued with a second IAM user on October 18. A separate October 8–11 campaign used customer-owned Qubole keys; Wiz cannot confirm a link. AWS and Qubole did not respond.
Unconfirmed: Wiz did not say how many organizations were hit, has not attributed the campaign, and cannot confirm the October 8–11 activity is the same campaign.
- Qubole uses cross-account IAM roles so customers need not share long-lived keys.
- Attackers read secrets in Lambda, Secrets Manager, and SSM Parameter Store.
- They used TruffleHog, found Entra ID secrets, and requested Okta OAuth tokens.
- Wiz called it a broad opportunistic campaign across multiple environments.
- Rotating a credential does not end temporary sessions already issued.
Impact: steal secrets, keys, and S3 data from customer AWS
| Product | Affected |
|---|---|
| Qubole | — |
- 1.Review CloudTrail from October 1 for AssumeRole events from account 805246085872.
- 2.If an integration role was assumed, rotate every secret, parameter, and Lambda variable it could read.
- 3.Revoke active sessions for that role; rotation does not end sessions already issued.
- ATT&CK
- T1078.004 Cloud AccountsT1530 Data from Cloud StorageT1528 Steal Application Access TokenT1552 Unsecured Credentials
- Products
- AWS
- Malware
- TruffleHog
From the original article
3 min read at theregister.comWiz researchers uncovered the secret-stealing supply-chain attack
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.