Mullvad

Qubole AWS IAM Credentials Compromised in Supply Chain Attack Targeting Over a Dozen Organizations

A threat actor leveraged stolen IAM credentials tied to Qubole’s AWS account to assume cross-account roles and exfiltrate data from more than a dozen customer environments. The attack exploited dormant IAM roles that organizations had created during Qubole onboarding but never removed after ending their relationship with the big-data platform. Attackers used the roles between October 14 and October 26 to enumerate resources, harvest secrets, and download entire S3 buckets. Activity originated from a rented OVH server and Mullvad VPN, with no traffic traced back to Qubole’s own infrastructure. Researchers from Sentra and Wiz observed consistent role session names prefixed with “quiam-” and noted the use of TruffleHog to validate stolen credentials. A separate campaign between October 8 and October 11 involved testing of customer-owned AWS access keys obtained through Qubole integrations.