Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

Attackers abused Qubole AWS trust to steal customer data

8 sources · 8 articlesFirst reported Updated ()1
What's new

November 10: BleepingComputer reported two compromised Qubole IAM users, a Sentra tip to Wiz, and downloads of every reachable S3 object, with Qubole still silent.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Attackers used stolen Qubole AWS credentials from October 14–26 to assume customer roles and steal secrets and S3 data; Qubole has not commented.

Unknown attackers used compromised IAM credentials for Qubole AWS account 805246085872 to assume customer cross-account roles from October 14 to October 26, 2026, Wiz says, working with Sentra and Mandiant. The actor enumerated resources, read Lambda variables, Secrets Manager, SSM Parameter Store and EC2 user data, tested AWS, Entra ID and Okta secrets with TruffleHog, and copied reachable S3 data. CSO Online, citing Sentra, said dozens of customers were affected; SecurityWeek, also citing Sentra, said more than a dozen organizations were hit. A separate October 8–11 use of customer-owned keys is unlinked, and the campaign is unattributed. Qubole had made no public announcement as of November 10, BleepingComputer reported.

Key facts
  • Qubole account 805246085872 was used, with session names starting quiam-.
  • Calls came from Mullvad VPN addresses and OVH host 57.129.54.120.
  • Stolen material included AWS keys, Entra ID secrets, and Okta credentials.
  • Sentra reported no writes and more than 100 secrets read within minutes.
  • Sentra told GBHackers one company lost millions of downloaded files.
  • An ISO named sso_agent.iso was found but not confirmed deployed.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 8, 2026Separate abuse of customer-owned AWS keys began · The Hacker News
  2. Oct 14, 2026Attackers began assuming roles from the Qubole account · Wiz Blog
  3. Oct 18, 2026A second IAM user joined the role assumptions · The Register
  4. Oct 26, 2026Observed cross-account role-assumption activity ended · Wiz Blog

What each outlet adds

beyond the shared facts
  • Wiz BlogFirst report of Mullvad and OVH sources and quiam- sessions.
  • The Hacker NewsNames attacker principal IDs and says a source-IP condition would have blocked them.
  • The RegisterDates a second IAM user to October 18; notes rotation does not end sessions.
  • CSO OnlineCites Sentra on dozens of victims, unused roles, and no writes.
  • BleepingComputerSays two IAM users were compromised and every reachable S3 object was downloaded.
Vendors
QuboleAmazon Web ServicesAmazonMicrosoftOktaIderaWiz
Products
AWS IAMAmazon S3AWS Secrets ManagerSecrets ManagerSystems Manager Parameter StoreMicrosoft Entra IDAWSTruffleHog
Malware
TruffleHog
Victims
customers using Qubole
Organizations
WizSentraMandiantGoogle

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Wiz BlogFirst report

    Qubole cross-account IAM roles abused in the wild

    Threat actors abused Qubole's cross-account IAM trust to access multiple customer AWS environments, enumerating resources and exfiltrating data.

  2. · 1d ago The Hacker News

    Attacker used Qubole AWS access to steal customer secrets and data

    Between October 14 and October 26 the attacker assumed customer IAM roles and copied secrets and S3 data; how the credentials were obtained is undisclosed.

  3. · 1d ago The Register · Security

    Attackers use Qubole AWS trust to steal customer secrets

    Wiz says compromised Qubole IAM credentials let attackers AssumeRole into multiple customer AWS accounts starting October 14.

  4. · 15h ago CSO Online

    Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials

    From October 14 to October 26, stolen Qubole AWS credentials let an attacker assume roles in dozens of customer accounts.

  5. · 14h ago GBHackers

    Attackers abused Qubole AWS trust to steal customer cloud data

    From October 14 to October 26, attackers assumed customer roles, harvested secrets, and downloaded S3 data, including millions of files at one firm.

  6. · 13h ago Cyber Security News

    Attackers abuse trusted Qubole IAM roles to steal AWS secrets and S3 data

    From October 14 to 26, 2026, attackers assumed customer roles via Qubole’s AWS account and sometimes downloaded entire buckets.

  7. · 13h ago SecurityWeek

    Stolen Qubole AWS credentials used to take data from over a dozen firms

    Dormant cross-account IAM roles were assumed from October 14 to October 26 to enumerate, harvest secrets, and download S3 data.

  8. · 7h ago BleepingComputer

    Attackers used Qubole AWS credentials to raid customer clouds

    From October 14 to 26 the actor assumed trusted roles, harvested secrets and downloaded S3 data from dozens of victims.