According to The Hacker News, an attacker compromised Amazon Web Services accounts belonging to multiple Qubole customers between Oct. 14 and Oct. 26, stealing stored secrets and sensitive data.
The attacker leveraged credentials associated with an AWS account used by the Qubole data lake platform to access customer environments. By assuming identity and access management roles that trusted the Qubole account, the unauthorized party bypassed security measures. Although the exact method of credential acquisition remains undisclosed, the attacker successfully accessed environment variables, secrets and parameters. The intruder utilized the TruffleHog tool to validate stolen access keys, Entra ID client secrets and Okta credentials. Furthermore, the attacker exfiltrated data from S3 buckets, often downloading entire contents in single sessions. Security researchers at Wiz identified the malicious activity and provided guidance for organizations to audit CloudTrail logs for suspicious AssumeRole requests originating from non-AWS IP addresses. Experts recommend that affected users rotate all exposed secrets, revoke active sessions and implement stricter source IP conditions to prevent future unauthorized access. The incident highlights the risks associated with broad permissions granted to third-party vendor roles and the necessity of monitoring cross-account access patterns to protect cloud infrastructure.
Source: The Hacker News
