Hackers Abuse Qubole’s Trusted AWS Access to Breach Multiple Cloud Accounts and Steal Sensitive Data

Hackers abused AWS credentials associated with Qubole to breach multiple customer cloud environments, harvest secrets, and steal sensitive S3 data between October 14 and October 26, 2026.

Sentra reported that more than a dozen organizations were hacked, describing the broader impact as involving dozens of Qubole customers.

Some compromised integration roles had remained dormant for months but retained extensive access to sensitive data, turning abandoned vendor connections into operational entry points.

Qubole integrations commonly rely on cross-account IAM roles. Customers configure these roles to trust the vendor’s AWS account, allowing authorized identities to obtain temporary credentials through sts:AssumeRole .

An External ID provides an additional check, but every attacker-attributed request observed by Wiz supplied one successfully.

According to the supplied Wiz findings, the initial activity originated from AWS account 805246085872 , using IAM principal AIDA3W7DIFLYOLTK63SFS .

On October 14, requests came from Mullvad VPN address 45.83.220[.]211 ; subsequent activity primarily used OVH-hosted infrastructure at 57.129.54[.]120 .

On October 18, the attacker began using a second principal, AIDAJYRRH5Y3A7AAJM2HW , and another Mullvad address, 185.209.199[.]73 .

Unlike the first principal, the second also appeared in legitimate Qubole traffic, making network context essential for distinguishing malicious sessions.

Session names such as quiam-enum and quiam-scope-full accompanied broad reconnaissance across storage, compute, databases, IAM, and encryption services.

Wiz investigated the campaign , alongside Sentra and Mandiant after Sentra identified suspicious activity across customer environments. The attackers exploited existing vendor trust relationships rather than directly compromising each organization.

Qubole’s Trusted AWS Access

After assuming customer roles, the attacker queried Lambda configurations for environment variables, retrieved Secrets Manager values, and accessed Systems Manager Parameter Store.

Sentra additionally documented credential collection through EC2 user data, illustrating how operational configuration became a secondary source of access.

The attacker used TruffleHog to validate discovered credentials. AWS keys were tested through GetCallerIdentity , while recovered Microsoft Entra ID service-principal secrets and Okta client credentials were checked against their respective identity services.

S3 theft followed a repeatable sequence: enumerate buckets, list objects, inspect metadata, and download accessible content through GetObject .

Wiz described opportunistic collection, including entire buckets in some sessions. Sentra reported millions of downloaded files across one affected company’s accounts.

Wiz also identified sso_agent.iso on the OVH address. The bootable Linux image collected host information, polled TCP port 23458 for shell scripts, and triggered a reboot after 90 minutes.

Its loading of the ntfs3 driver suggested intended interaction with Windows disks, but researchers found no confirmed deployments.

Separately, customer-owned AWS keys believed to support Qubole integrations were abused between October 8 and October 11.

Wiz could not connect that activity to the role-assumption campaign or attribute the main operation to a known group.

Organizations should review CloudTrail from October 1 onward for the identified principals, suspicious source networks, and subsequent secret or storage access.

Sensitive buckets require S3 data events or server access logging to establish object-level theft.

Containment requires removing unused vendor trust, restricting permissions and approved networks, rotating exposed secrets, and revoking issued sessions.

External IDs should not serve as standalone safeguards: valid vendor credentials and excessive standing permissions enabled this campaign to cross organizational boundaries.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Weekly Cybersecurity – Top 50 Biggest Cybersecurity Stories of the Week

One Identity Unveils Safeguard 9.0 for Simpler PAM

One Identity Unveils Active Roles 8.6 with Enhanced Security and Administration

One Identity Unveils Identity Manager 10.0 LTS with AI and Modern UX

OffSec Celebrates 20 Years of Practitioner-Built Training From the Creators of Kali Linux and OSCP

Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security