From October 14 to October 26, 2026, an unidentified attacker used compromised IAM credentials from an AWS account tied to big-data platform Qubole to get inside more than a dozen organizations’ cloud environments. Many had quit Qubole long before but never deleted the roles that let its account in. Each request carried the right External ID, so AWS took the intruder for Qubole.
Sentra, which spotted the campaign, says the attacker read about 100 passwords and keys in seven minutes from Secrets Manager, SSM Parameter Store, and Lambda settings. TruffleHog then tested stolen AWS, Entra ID, and Okta credentials, and some S3 buckets were downloaded whole. How the attacker got Qubole’s credentials hasn’t been disclosed, and Qubole hasn’t issued a statement or fix.
Wiz, which disclosed the findings with Sentra and Mandiant on November 9, tells organizations that integrated with Qubole to search CloudTrail from October 1 for role assumptions by account 805246085872 from non-AWS addresses, rotate anything an affected role could read, and revoke its sessions. Unused vendor roles should go; Wiz says a source-IP condition alone would have blocked every role assumption it saw.
Source: SecurityWeek
