{"id":"CMP-202611-ir4rkz","kind":"campaign","aliases":[],"related":[],"title":"Attackers use Qubole's AWS account to get into customers' AWS through their Qubole integration roles, stealing secrets and downloading S3 buckets (Wiz, Sentra, Mandiant)","description":null,"summary":"From 14 to 26 Oct 2026 an attacker used IAM user credentials from a Qubole-associated AWS account (805246085872) to assume the cross-account integration roles customers created for Qubole (the External ID check passed). Inside, it listed S3, EC2, RDS, Glue, IAM and KMS, read Lambda environment variables, Secrets Manager secrets and SSM parameters, checked the stolen AWS, Entra ID and Okta credentials with TruffleHog, and downloaded whole S3 buckets. Wiz saw several victim AWS environments, and Sentra saw it across several of its customers; victims are not named and the count is unknown. Separately, on 8-11 Oct, customer-owned AWS access keys made for Qubole integrations were all tested within an hour, and a few environments were compromised; Wiz has not tied this to the main activity. How the attacker got Qubole's credentials, and whether Qubole has confirmed, are unknown.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-09T17:10:23+00:00","products":[{"name":"Qubole","fixed":[],"vendor":"Qubole"},{"name":"AWS IAM","fixed":[],"vendor":"Amazon Web Services"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Any AWS account with an IAM role that trusts Qubole: search CloudTrail from 1 Oct 2026 for AssumeRole by account 805246085872 from outside AWS IP ranges; any activity by principal ID AIDA3W7DIFLYOLTK63SFS (attacker only); AIDAJYRRH5Y3A7AAJM2HW from non-AWS IPs (it also has legitimate traffic); role session names quiam-* (e.g. quiam-enum, quiam-scope-full); source IPs 57.129.54[.]120 and 2001:41d0:70d[:]7800:: (OVH), 45.83.220[.]211, 185.209.199[.]73, 89.37.63[.]175 (Mullvad VPN, shared exits). User agents (only meaningful with another indicator): Boto3/1.37.9 ... os/linux#6.12.111+deb13-amd64 ... lang/python#3.13.5; aws-cli/2.37.12 ... lang/python#3.14.6; Boto3/1.43.108 ... os/linux#6.1.0-53-arm64; Boto3/1.43.113 ... os/linux#7.0.0-38-generic; TruffleHog GetCallerIdentity bursts. After a suspicious session, review Secrets Manager GetSecretValue, SSM GetParameter, Lambda GetFunctionConfiguration and S3 GetObject (S3 object reads need data events or server access logs). Entra ID and Okta sign-in logs with a TruffleHog user agent. File sso_agent.iso SHA-256 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 (TCP port 23458); no deployment seen.","fix":"Find every IAM role that trusts an external account. Remove the Qubole trust if you don't use it. If you do, narrow the trusted principal from :root to the specific vendor principal and add an aws:SourceIp or aws:SourceVpce condition (a source IP condition alone would have blocked every attempt Wiz saw). Rotate the External ID and use a different one for each role, and cut integration roles down to least privilege (no Lambda config, Secrets Manager, SSM or broad S3 read). If you find hits: rotate every secret, parameter, Lambda environment variable and key the role could read, including Entra ID and Okta client secrets, and revoke active sessions (rotating a credential does not end sessions already issued). Rotate customer-owned AWS keys made for Qubole. Turn on an organization CloudTrail and S3 data events.","status":"open","published_at":null,"first_seen_at":"2026-11-09T17:10:23+00:00","triaged_at":"2026-11-09T17:10:23+00:00","updated_at":"2026-11-09T17:12:14+00:00","category":"vendor","confidence":null,"triage":{"cause":{"at":"2026-11-09T17:11:31Z","path":"third-party-breach","entry":"unknown","reason":"The attacker used IAM user credentials from a Qubole-associated AWS account to assume customers' cross-account integration roles, but the record states that how the attacker got Qubole's credentials is unknown, and the path runs through the Qubole provider.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-11':136B '-202611':27A '14':37B '2026':41B '26':39B '8':135B '805246085872':55B 'access':142B 'account':6A,54B,61B 'across':119B 'activ':168B 'associ':52B 'assum':57B 'attack':1A,43B,171B 'aw':5A,11A,53B,96B,113B,141B 'aws':30A 'bucket':22A,108B 'campaign':32B 'check':71B,93B 'cmp':26A 'compromis':159B 'confirm':180B 'count':130B 'creat':65B 'credenti':47B,101B,175B 'cross':60B 'cross-account':59B 'custom':10A,64B,123B,139B 'customer-own':138B 'download':20A,105B 'earli':34B 'early-warn':33B 'ec2':77B 'entra':97B 'environ':85B,114B,157B 'extern':69B 'get':8A 'glue':79B 'got':172B 'hour':153B 'iam':31A,45B,80B 'id':70B,98B 'insid':73B 'integr':15A,62B,147B 'ir4rkz':28A 'key':143B 'kms':82B 'lambda':84B 'list':75B 'made':144B 'main':167B 'manag':88B 'mandiant':25A 'name':127B 'oct':40B,137B 'okta':100B 'own':140B 'paramet':92B 'pass':72B 'qubol':3A,14A,51B,67B,146B,173B,178B 'qubole':29A 'qubole-associ':50B 'rds':78B 'read':83B 'role':16A,63B 's3':21A,76B,107B 'saw':110B,117B 'secret':18A,87B,89B 'sentra':24A,116B 'separ':133B 'sever':111B,120B 'ssm':91B 'steal':17A 'stolen':95B 'test':150B 'tie':163B 'trufflehog':103B 'unknown':132B,182B 'use':2A,44B 'user':46B 'variabl':86B 'victim':112B,124B 'warn':35B 'whether':177B 'whole':106B 'within':151B 'wiz':23A,109B,160B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["awsiam","iam","qubole"],"ptokens":["aws","iam","qubole"],"labels":["campaign","earlywarning","high","vendor"],"campaign_type":"breach","search_a":"'-202611':27A 'account':6A 'attack':1A 'aw':5A,11A 'aws':30A 'bucket':22A 'cmp':26A 'custom':10A 'download':20A 'get':8A 'iam':31A 'integr':15A 'ir4rkz':28A 'mandiant':25A 'qubol':3A,14A 'qubole':29A 'role':16A 's3':21A 'secret':18A 'sentra':24A 'steal':17A 'use':2A 'wiz':23A","search_b":"'-11':136B '14':37B '2026':41B '26':39B '8':135B '805246085872':55B 'access':142B 'account':54B,61B 'across':119B 'activ':168B 'associ':52B 'assum':57B 'attack':43B,171B 'aw':53B,96B,113B,141B 'bucket':108B 'campaign':32B 'check':71B,93B 'compromis':159B 'confirm':180B 'count':130B 'creat':65B 'credenti':47B,101B,175B 'cross':60B 'cross-account':59B 'custom':64B,123B,139B 'customer-own':138B 'download':105B 'earli':34B 'early-warn':33B 'ec2':77B 'entra':97B 'environ':85B,114B,157B 'extern':69B 'glue':79B 'got':172B 'hour':153B 'iam':45B,80B 'id':70B,98B 'insid':73B 'integr':62B,147B 'key':143B 'kms':82B 'lambda':84B 'list':75B 'made':144B 'main':167B 'manag':88B 'name':127B 'oct':40B,137B 'okta':100B 'own':140B 'paramet':92B 'pass':72B 'qubol':51B,67B,146B,173B,178B 'qubole-associ':50B 'rds':78B 'read':83B 'role':63B 's3':76B,107B 'saw':110B,117B 'secret':87B,89B 'sentra':116B 'separ':133B 'sever':111B,120B 'ssm':91B 'stolen':95B 'test':150B 'tie':163B 'trufflehog':103B 'unknown':132B,182B 'use':44B 'user':46B 'variabl':86B 'victim':112B,124B 'warn':35B 'whether':177B 'whole':106B 'within':151B 'wiz':109B,160B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":"2026-11-09T17:16:47+00:00","first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ir4rkz","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T17:10:23+00:00","fetched_at":"2026-11-09T17:10:23+00:00","note":null}],"documents":[{"id":108348,"url":"https://x.com/wiz_io/status/2119831204639699230","title":"@wiz_io: TRUSTED BY DEFAULT 🔑\n\nThird-party integrations make cloud life easier until they","kind":"post","source":"x","publisher":null,"text":"TRUSTED BY DEFAULT 🔑\n\nThird-party integrations make cloud life easier until they become a backdoor.\n\nWorking alongside Sentra and Mandiant, our team tracked an active campaign abusing Qubole cross-account trust relationships in AWS. Threat actors leveraged legitimate vendor IAM\n\nlikes 5 reposts 3","published_at":"2026-11-09T16:35:18+00:00","relation":"describes","confidence":null,"note":null},{"id":108130,"url":"https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild","title":"Trusted by Default: Qubole Cross-Account Access Abused in the Wild (Wiz)","kind":"blog","source":"blog","publisher":null,"text":"Wiz with Sentra and Mandiant: from 14 to 26 Oct 2026 a threat actor used IAM user credentials from Qubole-associated AWS account 805246085872 (principal IDs AIDA3W7DIFLYOLTK63SFS, attacker only; AIDAJYRRH5Y3A7AAJM2HW, also legitimate) to AssumeRole into customer Qubole integration roles with valid External IDs, session names quiam-*. Enumerated S3, EC2, RDS, Glue, IAM, KMS; harvested Lambda env vars, Secrets Manager, SSM parameters; validated found AWS, Entra ID and Okta credentials with TruffleHog; downloaded whole S3 buckets. IPs 57.129.54.120 and 2001:41d0:70d:7800:: (OVH), Mullvad 45.83.220.211, 185.209.199.73, 89.37.63.175. sso_agent.iso SHA-256 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 found on OVH IP, polls TCP 23458. Separate 8-11 Oct testing of customer-owned AWS keys made for Qubole integrations. Qubole confirmation, how creds obtained, number of victims unknown.","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}