An attacker used stolen credentials belonging to Qubole, a cloud data-processing and analytics platform, to get into the Amazon Web Services accounts of many of its customers and take their data. The campaign ran from 14 to 26 October and reached tens of companies whose AWS roles were set up to trust an account linked to Qubole. Researchers confirmed dozens of victims, and one customer alone lost millions of files.
How the attack worked
Many firms give outside providers access through cross-account roles in AWS. A trust policy names which external account may assume a role, and the provider then obtains temporary credentials. The attacker abused exactly this arrangement. Two Qubole identity and access management users were compromised, though how has not been disclosed. The attacker then assumed roles in customer accounts that trusted Qubole, many of them roles that were otherwise unused.
Inside those accounts the intruder surveyed cloud resources and pulled secrets from AWS Secrets Manager and the Systems Manager parameter store, and read the environment variables of Lambda functions. An open-source scanning tool was used to check whether the harvested AWS keys, Microsoft Entra ID client secrets and Okta credentials were still valid, which widened the potential damage beyond AWS. One data security firm said the attacker collected about 100 passwords and keys in seven minutes.
Having gained deeper access, the attacker downloaded the contents of every storage bucket the roles could reach. A cloud security firm that investigated described the method as opportunistic rather than aimed at particular data. The steps were the same in each environment: assume a role, list the buckets it can reach, inspect the objects and download them.
Responses
The incident was flagged first by a data security company that saw suspicious activity in some of its customers' environments, and a cloud security firm and an incident-response company joined the investigation. Qubole had not published any notice, and it did not reply to a request for comment at the time of writing.
An AWS spokesperson said on 11 November that its services were not compromised and worked as designed. The spokesperson said the activity involved credentials tied to a third-party provider being used to assume roles that customers had set up to trust that provider. AWS advised customers to review cross-account roles regularly, remove integrations they no longer use, apply least-privilege permissions and add conditions such as source IP limits to trust policies.
What administrators should do
Companies that trusted Qubole should review audit logs from 1 October onward for access from its account, look for follow-on access to secrets and storage, rotate any exposed AWS, Entra ID and Okta credentials, revoke active role sessions, remove unused third-party integrations and narrow the permissions, trusted identities and permitted networks of the roles that remain. The case shows how one provider's stolen keys can become a route into the storage, secrets and connected services of many customers at once.
