Attackers Use Qubole Credentials to Breach Customer AWS Accounts

Between October 14 and October 26, attackers accessed AWS accounts of multiple Qubole customers using credentials for Qubole’s AWS account. Wiz disclosed the incident. How the attackers obtained Qubole’s credentials remains undisclosed. Qubole, a data lake platform owned by Idera, operates within customer AWS accounts through IAM roles with trust policies that allow Qubole’s account to assume them. Attackers exploited this trust to assume the customer roles.

Once inside customer environments, attackers read environment variables from Lambda functions, extracted secrets from Secrets Manager, and retrieved parameters from SSM Parameter Store. They tested the extracted credentials using TruffleHog, validating customers’ AWS access keys, Entra ID client secrets, and Okta credentials. Attackers also accessed data stored in S3 buckets, retrieving any objects that the assumed roles could access and in some cases downloading entire buckets in single sessions.

Researchers noted that most of the assumed roles were unused but still maintained trust in Qubole’s account. Neither Qubole nor Idera published statements about the incident. Organizations using Qubole should examine CloudTrail logs from October 1 onward for AssumeRole requests from account 805246085872 originating outside AWS infrastructure. Wiz provided specific detection indicators including IAM principal IDs, IP addresses from hosting providers and VPN services, session naming patterns, and user agent strings. Recommended mitigations include rotating exposed secrets, restricting role access to specific IAM principals and source IP ranges, removing unused vendor roles, and enabling comprehensive logging for S3 and other sensitive services.