Hunt: AssumeRole from Qubole's AWS account 805246085872 outside AWS IP space, quiam-* session names and TruffleHog GetCallerIdentity bursts

hunt leads and IOCs from Wiz (Nov 9, 2026); Mullvad addresses are shared VPN exits and are not conclusive alone2026-11-09

CloudTrail AssumeRole: userIdentity.accountId = 805246085872 with a sourceIPAddress that isn't an AWS address; any use of principal AIDA3W7DIFLYOLTK63SFS (seen only with the attacker); AIDAJYRRH5Y3A7AAJM2HW from a non-AWS address (this one also carries legitimate traffic).
Session names: quiam- prefix, for example quiam-enum and quiam-scope-full. Follow each session into Secrets Manager GetSecretValue, SSM GetParameter, Lambda GetFunctionConfiguration and S3 GetObject.
IPs: 57.129.54[.]120 (OVH, primary, Oct 15 to 26), 2001:41d0:70d:7800:: (OVH), 45.83.220[.]211, 185.209.199[.]73 and 89.37.63[.]175 (Mullvad exits).
Credential testing: GetCallerIdentity calls with a TruffleHog user agent alongside those IPs; check Entra ID and Okta sign-in logs for the same user agent.
Host IOC: sso_agent.iso, SHA-256 65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4, which polls 57.129.54[.]120 on TCP 23458 and reboots after 90 minutes. Wiz hasn't seen it deployed.
Logging gap: management events show the role assumption and bucket listing but not object reads. Without S3 data events or server access logs you can't tell which objects were taken.