Title: A Threat Actor Assumed Customer IAM Roles from Qubole’s AWS Account and Stole Secrets and S3 Data
Summary:
Wiz, working with Sentra and Mandiant, reports that a threat actor used IAM credentials belonging to AWS account 805246085872 — the account Qubole’s data platform uses to assume customer integration roles — to call sts:AssumeRole against customers’ roles between October 14 and 26, 2026. The first request came through a Mullvad VPN address, then via an OVH-hosted VPS; every assumed role trusted Qubole’s account and every request carried a valid External ID, so all succeeded — including roles no longer in legitimate use, because their trust policies were never removed. Inside victim environments the actor enumerated broadly, read Lambda environment variables, Secrets Manager values and SSM parameters, validated discovered keys (AWS, Entra ID and Okta) with TruffleHog, and exfiltrated S3 data — sometimes entire buckets in one session — naming role sessions quiam-enum and quiam-scope-full. Separately, another actor used customer-owned AWS access keys presumably created for Qubole integrations from October 8 to 11, in a small number of cases compromising the victim’s cloud environment; Wiz has not linked that activity to the role assumption. A bootable sso_agent.iso image hosted on the actor infrastructure hints at further operations but has not been seen deployed. Organizations that ever connected Qubole to AWS should review CloudTrail from October 1 onward in every account holding an integration role: look for AssumeRole from account 805246085872 with a non-AWS source IP, the principal ID AIDA3W7DIFLYOLTK63SFS (seen only with the threat actor), and Wiz’s listed IPs; for every suspicious session, rotate every secret the role could read and revoke sessions — rotating a credential does not end temporary sessions already issued. Wiz notes a source-IP condition on the trust policy alone would have blocked every role assumption observed, and AWS is explicit that the External ID is not a secret. Neither Qubole nor owner Idera had posted a statement when The Hacker News checked on November 9.
References: