Attackers abused Qubole AWS roles to steal customer secrets

Wiz researchers said on Monday that attackers used compromised identity and access management credentials linked to Qubole's AWS account to assume customer-managed AWS roles and steal secrets and data from S3 buckets. The cloud security company described the campaign as a "broad, opportunistic supply chain campaign" that hit multiple customer environments, though it did not say how many organizations were affected.

Qubole runs a cloud data processing service that relies on cross-account IAM roles to handle compute and reach customer AWS storage, so customers do not have to issue long-lived AWS access keys. Those third-party trust relationships became the entry point for the abuse.

Wiz traced the first malicious activity to October 14, after AI data security firm Sentra flagged suspicious behavior and Google's Mandiant joined the response; on that date, credentials from Qubole's AWS account 805246085872 invoked the sts:AssumeRole API to get temporary credentials. The calls originated from IAM user ID AIDA3W7DIFLYOLTK63SFS; Wiz analysts Zack Morrow, Sean Johnstone, and Benjamin Read said they saw no activity from this user except the threat actor's.

The activity went on into October 15, and by October 18 the attackers started using another IAM user from the same AWS account. Once inside victim environments, the attackers listed AWS resources and took credentials, keys, and other secrets from Lambda, Secrets Manager, and SSM Parameter Store. The attackers also used TruffleHog to test AWS credentials, discover Microsoft Entra ID secrets, and request OAuth tokens with Okta client credentials found in the environments.

The intruders downloaded data from customer S3 buckets, sometimes pulling entire buckets, which researchers said pointed to largely opportunistic targeting rather than a state-sponsored espionage hunt for specific data. Wiz has not attributed the campaign to a particular group and said it has no insight into how stolen data is being used.

Many organizations had kept Qubole trust policies active even after they stopped using the platform, which helped the attack succeed. The researchers told The Register: "Because many organizations left trust policies active even after deprecating the platform, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and siphon data".

Wiz also found a separate campaign from October 8 to October 11 that involved customer-owned AWS access keys meant for Qubole integrations. A small number of those also resulted in compromises of victim AWS environments, but Wiz said it could not definitively connect the two sets of malicious activity.

AWS and Qubole did not respond to The Register's inquiries. Administrators who have integrated with Qubole should rotate credentials, though rotating a credential does not end temporary sessions already issued. They should check CloudTrail logs from October 1 forward for AssumeRole events where userIdentity.accountId is 805246085872, Qubole's AWS account ID, especially events from IP addresses outside AWS. For each role session, researchers recommended checking all later activity, focusing on Secrets Manager, SSM Parameter Store, Lambda, and S3, and rotating every secret, parameter, and Lambda environment variable the role could access, then revoking active sessions.

Update, November 10, 2026

SecurityWeek reported on Tuesday that attackers hit more than a dozen organizations through the Qubole AWS roles, according to Wiz and Sentra. The roles stayed unused until October 14 and were then used through October 26 to list resources, gather secrets and configuration data, and retrieve information. Sentra said the traffic used a rented OVH server and the Mullvad VPN, and none of it came from Qubole’s own network. Wiz said role session names followed a “quiam-” prefix with a suffix for the action, such as “quiam-enum” and “quiam-scope-full”. Wiz also identified an ISO file that could be booted remotely on victim machines to collect data, but said it saw no evidence the file was used.

Update, November 10, 2026

BleepingComputer reported on Tuesday that the Qubole AWS role abuse affected tens of companies, citing Wiz and Sentra. Sentra confirmed dozens of victims and said millions of files were stolen from one customer alone. Sentra also said the attacker gathered 100 passwords and keys within seven minutes. BleepingComputer said it could not find a public announcement from Qubole and has emailed the company for comment.