Qubole AWS integration supply-chain attack: attackers assume cross-account IAM roles to steal secrets and S3 data
Severity: high · Patch status: no-fix-needed · Since 2026-11-09
Attackers used compromised IAM credentials tied to Qubole's AWS account (805246085872) to call sts:AssumeRole and obtain temporary credentials for customer-managed integration roles, exploiting trust policies left active even after customers deprecated the platform. From October 14, 2026, they enumerated cloud resources, harvested secrets from Lambda, Secrets Manager and SSM Parameter Store, used TruffleHog to validate credentials, obtained Microsoft Entra ID and Okta OAuth secrets, and siphoned data from S3 buckets, in some cases downloading entire buckets. Wiz, working with Mandiant after Sentra flagged activity, calls it a broad, opportunistic supply-chain campaign affecting multiple organizations; no attribution. Neither AWS nor Qubole responded. Remediation is credential rotation, session revocation and CloudTrail review; no vendor patch applies.
What to do
- Rotate all credentials, secrets, parameters and Lambda environment variables any Qubole integration role could read, and revoke active role sessions
- Review CloudTrail from October 1 onward for AssumeRole events with userIdentity.accountId 805246085872, especially from non-AWS IPs
- Review all subsequent activity from any matching role sessions, especially Secrets Manager, SSM Parameter Store, Lambda and S3
- Remove or restrict trust policies for deprecated third-party integrations
Sources
All live incidents on Threat Watch
