Idera

Attackers Abuse Qubole Trusted AWS Roles to Breach Customer Accounts and Exfiltrate Secrets

Between October 14 and October 26, an attacker used credentials belonging to Qubole's own AWS account to assume IAM roles in multiple customer environments and steal secrets and data. The compromise affected organizations that had previously connected the Qubole data lake platform, owned by Idera, to their AWS accounts via cross-account role trust policies. Security researchers at Wiz discovered the activity after Sentra flagged suspicious AssumeRole calls from the account ID 805246085872. The attacker enumerated unused roles, read Lambda environment variables, Secrets Manager entries and SSM Parameter Store values, then validated stolen credentials with TruffleHog before copying data from accessible S3 buckets. A separate, unrelated campaign between October 8 and 11 used customer-supplied AWS access keys also configured for Qubole. Wiz has published detailed CloudTrail hunting queries covering the period from October 1 onward and recommends immediate rotation of secrets and removal of unnecessary Qubole roles.