An attacker used credentials from an Amazon Web Services (AWS) account tied to Qubole, a cloud data-processing platform, to enter customers' AWS environments and steal passwords, keys and stored files, The Register reported Monday, citing research by cloud security firm Wiz. Customers had opened that door themselves, and many never closed it after leaving the service, a direct test of how companies govern vendor access.
What Happened
Qubole works inside customer accounts through cross-account roles: permissions a customer creates in its own AWS account that a vendor's identity can borrow. A code called an External ID is meant to confirm each request.
From Oct. 14 to Oct. 26, Wiz said, an attacker using identities in a Qubole-associated account assumed those roles across multiple customer environments. Every request carried the correct External ID and succeeded. In most environments Wiz examined, those were the vendor account's only October requests: the roles sat idle but active.
Inside, the attacker mapped storage, servers, databases and identities, pulled secrets from services where companies keep passwords and keys, and downloaded files, sometimes whole storage buckets. With an open-source tool called TruffleHog, the attacker then tested harvested AWS keys and tried credentials for Microsoft Entra ID and Okta, systems that control employee and application sign-ins.
Sentra, the data security company that first spotted the activity, said in its own research that dozens of Qubole customers were hit and that about 100 passwords and keys were read in roughly seven minutes. It saw no changes or deletions. Wiz declined to give a victim count, calling it a "broad, opportunistic supply chain campaign," The Register reported. Google's Mandiant assisted. Qubole did not respond to The Register. AWS later told the outlet its services "were not compromised by this issue and operated as designed."
Wiz has not linked the campaign to a known group and said the targeting does not fit typical state-backed priorities. It has not tied separate misuse of customer-owned Qubole keys Oct. 8-11 to the main campaign.
Why It Matters
As Sentra noted, no victim was broken into directly; the attacker rode permissions companies had granted and forgotten. The stolen Entra ID and Okta credentials matter most, because they can open email, files and business applications far beyond the cloud accounts first entered. Wiz said it cannot see how the stolen data is being used.
The Primary Wire reported a similar case in October, when a backup vendor's credential opened customers' Microsoft 365 environments.
What to Watch
Wiz advised organizations that connected Qubole to review AWS activity logs back to Oct. 1, remove vendor trust for integrations no longer in use, tie remaining vendor roles to specific vendor identities and network addresses, and stop treating External IDs as secret, since they appear in plain text in logs. Where the attacker used a role, every secret it could read should be changed and its sessions ended, Wiz said, since changing credentials alone does not cut off existing sessions.
Still unanswered: how Qubole's credentials were compromised, which customers will disclose harm, and whether stolen identity credentials resurface in later intrusions.
