Hackers Breach Qubole AWS Account, Steal Customer Cloud Data

Threat actors compromised identity and access management (IAM) credentials for a Qubole big data platform’s AWS account, leading to data exfiltration from multiple customer cloud environments in a sophisticated supply chain attack.

The campaign, which ran between October 14 and 26, affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated with Qubole. Qubole is an enterprise cloud data processing and analytics platform that offers AWS integration for managing computing resources.

Organisations grant third-party providers like Qubole access to their AWS resources by creating cross-account IAM roles, highlighting the critical need for robust access controls and zero-trust security models. Trust policies dictate which external AWS accounts can assume these roles, with permissions defining the allowed resources and actions.

Cloud security company Wiz began investigating the attack after data security and governance firm Sentra observed suspicious activity in some customer environments. Cybersecurity company Mandiant also joined the investigation.

Researchers discovered that the attackers compromised two Qubole IAM users. They then assumed previously unused roles in multiple customer AWS accounts that trusted Qubole’s account, granting them broad access within the roles’ defined permissions. External providers typically use AWS’s Security Token Service (STS) AssumeRole API to obtain temporary credentials for accessing customer cloud resources.

Attackers Surveyed Resources and Stole Secrets

Once inside, the threat actor surveyed cloud resources, retrieved secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables. They reportedly used the TruffleHog tool to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.

The attack method was consistent across environments: assume a role, call ListBuckets to identify accessible storage, use ListObjects and HeadObject to enumerate and inspect contents, then execute GetObject to download data. Attackers downloaded data from all accessible S3 buckets in the AWS environment, indicating an opportunistic approach rather than targeting specific datasets.

The report did not specify the exact method used to compromise the initial Qubole accounts or the total number of downstream victims. However, Sentra confirmed that dozens of victims were impacted, with millions of files stolen from one customer alone. Attackers moved swiftly, collecting secrets at a rate of 100 passwords and keys within seven minutes.

Qubole has not issued a public announcement regarding this incident. Privacy Needle has reached out to the company for more information but has not yet received a response.

Recommendations for Affected Organisations

Potentially impacted administrators are advised to review CloudTrail logs from October 1 onwards for any suspicious access originating from Qubole’s AWS account. Further investigation into subsequent secret and S3 access is recommended, along with rotating any exposed credentials and revoking active role sessions.

Organisations should also remove unused third-party integrations and restrict permissions, trusted identities, and permitted source networks for any remaining roles to minimise potential attack surfaces.