Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials

An attacker has abused AWS cross-account IAM roles to access multiple customer environments, steal data, and harvest credentials in a supply-chain attack that ran between October 14 and October 26.

Researchers from Wiz, working with Sentra and Mandiant, said they observed an attacker using IAM credentials for Qubole’s AWS account to assume roles in customer environments.

The compromised credentials allowed the attacker to access customer AWS accounts that had previously established cross-account access permissions with Qubole. The access was used to enumerate cloud resources, retrieve secrets and configuration data, download files from Amazon S3 , and test credentials belonging to affected organizations.

Sentra, which initially identified suspicious activity across several customer environments, said the campaign affected dozens of Qubole customers. The attacker was said to have exploited integrations that remained trusted even after some organizations had stopped using the platform.

Attackers used Qubole’s AWS credentials

Qubole integrations rely on cross-account Identity and Access Management ( IAM ) roles. Customers typically create roles that allow identities belonging to Qubole’s AWS account to assume them, with an External ID serving as an additional check against unauthorized access.

The attacker had credentials that could satisfy this requirement.

Wiz said the first suspicious activity was observed on October 14, when an IP address associated with Mullvad VPN attempted to assume customer integration roles from AWS account 805246085872, which Qubole uses for its platform operations. The requests used an IAM user identified as AIDA3W7DIFLYOLTK63SFS.

Most of the activity that came later originated from an OVH-hosted VPS, 57.129.54[.]120. The attacker also began using a second IAM identity associated with Qubole’s AWS account on October 18, alongside another Mullvad VPN address.

All malicious role-assumption requests identified by Wiz included the required External ID and succeeded. Many of the targeted roles had seen no legitimate Qubole activity during October, but their permissions remained active.

After gaining access, the attacker enumerated cloud resources, including S3 buckets, databases, EC2 instances, security groups and IAM identities. The intruder also accessed AWS Secrets Manager, Systems Manager Parameter Store and Lambda function configurations to retrieve credentials and other sensitive information.

Attackers stole data, and hosted a suspicious Linux image

The attacker used the assumed roles to download data from Amazon S3, enumerating accessible buckets and objects before retrieving their contents. In some instances, Wiz said, entire buckets were downloaded in individual sessions.

Credentials discovered in the compromised environments were subsequently tested using TruffleHog, a secrets-scanning tool. These included AWS access keys, Microsoft Entra ID service principal credentials and Okta OAuth client credentials.

Sentra reported identifying more than 100 passwords and keys read within minutes, alongside thousands of additional credential records contained in downloaded files. The company also said the attacker performed no write operations in the observed environments, suggesting an operation focused on data theft.

Wiz also found a bootable Linux ISO image, named “sso_agent.iso,” hosted on the attacker’s OVH infrastructure. The image collects system information, communicates with the server over TCP port 23458, and can execute remotely supplied shell commands. Its configuration suggests it may have been designed to target Windows systems, the researchers said in a blog post .

Wiz, however, did not find any deployments of the image and could not confirm whether it had been used against victims.

The campaign has not been attributed to a known threat group.

Tightening integrations and third-party access will help

Wiz recommends that organizations using Qubole review AWS CloudTrail records dating back to October 1, 2026, across all accounts containing integration roles. Investigators should look for suspicious AssumeRole activity originating from Qubole’s AWS account, particularly requests from non-AWS infrastructure and IAM identities identified in the disclosure.

Subsequent activity involving Secrets Manager, Parameter Store, Lambda and S3 should also be investigated, Wiz noted. Other recommendations include removing unused third-party integrations and narrowing trust policies to specific vendor IAM principals rather than allowing an entire external AWS account to assume a role. Organizations should also restrict role assumption to documented vendor network ranges using AWS source IP or VPC endpoint conditions.