Cloud Security Alert: Malicious Actors Exploit Qubole Cross-Account Access to Breach Multiple AWS Environments
A sophisticated security incident involving the data lake platform Qubole has resulted in unauthorized access to the Amazon Web Services (AWS) environments of multiple corporate customers. Between October 14 and October 26, 2026, an unidentified threat actor successfully leveraged legitimate cross-account trust relationships to exfiltrate sensitive data and harvest credentials from various cloud infrastructures. The breach, first brought to light by researchers at cloud security firm Wiz, highlights a critical vulnerability in the way third-party service providers manage IAM (Identity and Access Management) roles, potentially exposing thousands of organizations that rely on integrated cloud data platforms.
The core of the issue lies in the trust architecture between Qubole—a data analytics platform now owned by Idera—and its customers. To facilitate seamless data processing, Qubole requires customers to create an IAM role within their own AWS accounts. This role, governed by a specific trust policy, permits the Qubole AWS account to "assume" the role, thereby granting the platform the permissions necessary to read, write, and analyze data stored in the customer’s S3 buckets and associated services. According to standard AWS protocols, this AssumeRole request must be accompanied by an "External ID," a unique identifier intended to prevent the "confused deputy" problem, where a third party might be tricked into performing unauthorized actions.
Chronology of the Exploitation
The timeline of this incident suggests a two-pronged approach by the threat actor, beginning earlier in October. Investigations revealed that from October 8 to October 11, attackers initially targeted customers using static AWS access keys, which had been previously configured for Qubole integration. This initial phase involved compromising a limited subset of environments.
However, the more significant breach occurred between October 14 and October 26, when the attacker shifted tactics to exploit the cross-account IAM roles directly. By utilizing the credentials associated with the Qubole platform’s own AWS account (identified as 805246085872), the attacker bypassed standard perimeter defenses. Wiz researchers noted that even in cases where the Qubole integration was no longer actively used, the trust relationship often remained in place. Because these roles still trusted the Qubole account, the attacker’s requests were accepted by AWS as legitimate, provided the correct External ID was included in the request.
While the External ID is often treated as a security barrier, AWS documentation specifies that it is not a secret; it is a shared identifier meant to provide a measure of protection against unauthorized third-party access. In this instance, the attacker had clearly obtained the necessary information to authenticate these requests, effectively masking their movements as legitimate platform maintenance or data processing tasks.
Tactical Execution and Data Exfiltration
Upon gaining entry into the victims’ AWS environments, the attacker engaged in a systematic search for high-value intelligence. The methodology was highly automated and designed to harvest credentials that could be used for lateral movement or external exploitation.
The attacker specifically targeted:
- Environment Variables: Scanning Lambda functions for hardcoded credentials or API keys.
- Secrets Manager: Querying the service for stored database passwords, encryption keys, and third-party API tokens.
- SSM Parameter Store: Extracting configuration data and sensitive values stored in the System Manager.
Once the credentials were obtained, the attacker employed the open-source tool TruffleHog to validate the stolen keys. This automated verification process allowed the attacker to filter out expired or non-functional credentials, focusing their efforts on live AWS access keys, Microsoft Entra ID client secrets, and Okta administrative credentials.
Beyond credential harvesting, the attacker engaged in massive data exfiltration from S3 storage buckets. Unlike targeted data theft, the perpetrator adopted a "grab everything" strategy. The logs indicate that in several instances, the attacker downloaded the entire contents of an S3 bucket in a single session. This indiscriminate approach suggests that the primary goal was the rapid accumulation of data before detection could occur.
Broader Implications for Cloud Governance
The incident at Qubole serves as a stark reminder of the "shared responsibility model" in cloud computing. While AWS provides the infrastructure, the security of IAM roles and the maintenance of trust policies remain the responsibility of the customer. The fact that the attacker was able to exploit unused roles underscores the dangers of "permission creep"—the accumulation of excessive or obsolete access privileges that remain active long after their utility has expired.
Security analysts point out that the lack of granular logging further complicated the post-incident response. While AWS CloudTrail captures the "AssumeRole" events and bucket-listing requests, it does not inherently log which specific S3 objects were accessed unless S3 data events or server access logs are explicitly enabled. Many of the affected organizations lacked this level of detailed logging, leaving a significant gap in the forensic analysis and preventing a full assessment of what specific data was compromised.
Furthermore, the nature of the attack does not mirror the typical patterns observed in state-sponsored espionage or traditional ransomware campaigns. The targeting was broad, and the tools utilized—such as TruffleHog—are standard in both security auditing and malicious credential harvesting. This suggests an opportunistic attacker, possibly a financially motivated group, rather than a sophisticated Advanced Persistent Threat (APT) actor.
Official Responses and Mitigation Efforts
As of the time of reporting, neither Qubole nor its parent company, Idera, have issued a formal public statement regarding the incident. The silence from the service provider has left many affected customers in a state of uncertainty, forcing internal security teams to conduct their own investigations and forensic sweeps.
Wiz, in its technical advisory, has provided clear guidance for organizations that have ever integrated Qubole with their AWS environment. The primary recommendation is to conduct a thorough audit of CloudTrail logs dating back to October 1. Organizations are urged to look for AssumeRole requests originating from the Qubole-associated account ID (805246085872) that do not correspond to scheduled maintenance or expected analytical workloads.
To harden environments against similar future threats, security professionals recommend:
- Strict Least-Privilege Policies: Review all IAM trust policies. If a service is no longer in use, the associated IAM role must be deleted immediately.
- Enable Detailed Logging: Ensure that S3 data events are enabled for all sensitive buckets, as this is the only way to track object-level access during an unauthorized session.
- Regular Credential Rotation: Rotate all AWS access keys, Entra ID secrets, and Okta tokens that may have been stored in the environment during the period of the breach.
- Anomaly Detection: Implement monitoring solutions that trigger alerts for
AssumeRoleevents occurring from unusual IP addresses or at irregular times.
Conclusion
The Qubole breach is a definitive example of how trust-based relationships can be weaponized in modern cloud architectures. By compromising a single point of entry—a trusted service provider—the attacker gained a high-leverage position that spanned multiple independent customer environments. As companies continue to lean heavily on third-party SaaS and PaaS providers for data analytics and processing, the security of these integrations must become a cornerstone of corporate risk management.
Without proactive hygiene—such as the decommissioning of unused roles and the implementation of comprehensive data access logging—organizations remain vulnerable to "confused deputy" style attacks that exploit the very permissions designed to make cloud computing efficient. As the investigation into this incident continues, it is expected that industry standards for third-party IAM management will face renewed scrutiny, potentially leading to more rigorous security requirements for integrated cloud platforms. Organizations are advised to treat all third-party integrations as potential attack vectors and to prioritize the visibility of their cross-account access policies in their ongoing security posture assessments.
