---
id: "CMP-202611-ir4rkz"
page: "https://infrastack.ai/live/CMP-202611-ir4rkz"
kind: "campaign"
aliases: []
title: "Attackers use Qubole's AWS account to get into customers' AWS through their Qubole integration roles, stealing secrets and downloading S3 buckets (Wiz, Sentra, Mandiant)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Qubole", "fixed": [], "vendor": "Qubole"}, {"name": "AWS IAM", "fixed": [], "vendor": "Amazon Web Services"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-09T17:10:23+00:00"
updated_at: "2026-11-09T17:12:14+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-09T17:10:23+00:00"}]
exploit_sources: []
---

# Attackers use Qubole's AWS account to get into customers' AWS through their Qubole integration roles, stealing secrets and downloading S3 buckets (Wiz, Sentra, Mandiant)

Link for people: https://infrastack.ai/live/CMP-202611-ir4rkz (this .md is for agents)

From 14 to 26 Oct 2026 an attacker used IAM user credentials from a Qubole-associated AWS account (805246085872) to assume the cross-account integration roles customers created for Qubole (the External ID check passed). Inside, it listed S3, EC2, RDS, Glue, IAM and KMS, read Lambda environment variables, Secrets Manager secrets and SSM parameters, checked the stolen AWS, Entra ID and Okta credentials with TruffleHog, and downloaded whole S3 buckets. Wiz saw several victim AWS environments, and Sentra saw it across several of its customers; victims are not named and the count is unknown. Separately, on 8-11 Oct, customer-owned AWS access keys made for Qubole integrations were all tested within an hour, and a few environments were compromised; Wiz has not tied this to the main activity. How the attacker got Qubole's credentials, and whether Qubole has confirmed, are unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Qubole affected range not listed fixed no fixed version listed
- :AWS IAM affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The attacker used IAM user credentials from a Qubole-associated AWS account to assume customers' cross-account integration roles, but the record states that how the attacker got Qubole's credentials is unknown, and the path runs through the Qubole provider.

How it reached others: customers' data or keys went with it (third-party-breach).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach

## How to check

Any AWS account with an IAM role that trusts Qubole: search CloudTrail from 1 Oct 2026 for AssumeRole by account 805246085872 from outside AWS IP ranges; any activity by principal ID AIDA3W7DIFLYOLTK63SFS (attacker only); AIDAJYRRH5Y3A7AAJM2HW from non-AWS IPs (it also has legitimate traffic); role session names quiam-* (e.g. quiam-enum, quiam-scope-full); source IPs 57.129.54[.]120 and 2001:41d0:70d[:]7800:: (OVH), 45.83.220[.]211, 185.209.199[.]73, 89.37.63[.]175 (Mullvad VPN, shared exits). User agents (only meaningful with another indicator): Boto3/1.37.9 ... os/linux#6.12.111+deb13-amd64 ... lang/python#3.13.5; aws-cli/2.37.12 ... lang/python#3.14.6; Boto3/1.43.108 ... os/linux#6.1.0-53-arm64; Boto3/1.43.113 ... os/linux#7.0.0-38-generic; TruffleHog GetCallerIdentity bursts. After a suspicious session, review Secrets Manager GetSecretValue, SSM GetParameter, Lambda GetFunctionConfiguration and S3 GetObject (S3 object reads need data events or server access logs). Entra ID and Okta sign-in logs with a TruffleHog user agent. File sso_agent.iso SHA-256 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4 (TCP port 23458); no deployment seen.

## Fix

Find every IAM role that trusts an external account. Remove the Qubole trust if you don't use it. If you do, narrow the trusted principal from :root to the specific vendor principal and add an aws:SourceIp or aws:SourceVpce condition (a source IP condition alone would have blocked every attempt Wiz saw). Rotate the External ID and use a different one for each role, and cut integration roles down to least privilege (no Lambda config, Secrets Manager, SSM or broad S3 read). If you find hits: rotate every secret, parameter, Lambda environment variable and key the role could read, including Entra ID and Okta client secrets, and revoke active sessions (rotating a credential does not end sessions already issued). Rotate customer-owned AWS keys made for Qubole. Turn on an organization CloudTrail and S3 data events.

## Timeline

- 2026-11-09T17:10:23+00:00 analyst

## Documents

- [describes] @wiz_io: TRUSTED BY DEFAULT 🔑

Third-party integrations make cloud life easier until they https://x.com/wiz_io/status/2119831204639699230
- [describes] Trusted by Default: Qubole Cross-Account Access Abused in the Wild (Wiz) https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_