---
title: Hunt: AssumeRole from Qubole's AWS account 805246085872 outside AWS IP space, quiam-* session names and TruffleHog GetCallerIdentity bursts | ctxsec
url: https://ctxsec.com/items/hunt-qubole-account-805246085872-assumerole-non-aws-ip-quiam-sessions
description: "Wiz's indicators let you separate the attacker from legitimate Qubole traffic, which always came from AWS infrastructure. Check every account that holds a Qubole integration role, starting Oct 1, 2026."
status: "hunt leads and IOCs from Wiz (Nov 9, 2026); Mullvad addresses are shared VPN exits and are not conclusive alone"
published: 2026-11-09
---

> Wiz's indicators let you separate the attacker from legitimate Qubole traffic, which always came from AWS infrastructure. Check every account that holds a Qubole integration role, starting Oct 1, 2026.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-qubole-account-805246085872-assumerole-non-aws-ip-quiam-sessions.md)

hunt leads and IOCs from Wiz (Nov 9, 2026); Mullvad addresses are shared VPN exits and are not conclusive alone

2026-11-09

### Hunt: AssumeRole from Qubole's AWS account 805246085872 outside AWS IP space, quiam-* session names and TruffleHog GetCallerIdentity bursts

- **CloudTrail AssumeRole:** `userIdentity.accountId = 805246085872` with a `sourceIPAddress` that isn't an AWS address; any use of principal `AIDA3W7DIFLYOLTK63SFS` (seen only with the attacker); `AIDAJYRRH5Y3A7AAJM2HW` from a non-AWS address (this one also carries legitimate traffic).
- **Session names:** `quiam-` prefix, for example `quiam-enum` and `quiam-scope-full`. Follow each session into Secrets Manager `GetSecretValue`, SSM `GetParameter`, Lambda `GetFunctionConfiguration` and S3 `GetObject`.
- **IPs:** `57.129.54[.]120` (OVH, primary, Oct 15 to 26), `2001:41d0:70d:7800::` (OVH), `45.83.220[.]211`, `185.209.199[.]73` and `89.37.63[.]175` (Mullvad exits).
- **Credential testing:** `GetCallerIdentity` calls with a `TruffleHog` user agent alongside those IPs; check Entra ID and Okta sign-in logs for the same user agent.
- **Host IOC:** `sso_agent.iso`, SHA-256 `65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4`, which polls `57.129.54[.]120` on TCP 23458 and reboots after 90 minutes. Wiz hasn't seen it deployed.
- **Logging gap:** management events show the role assumption and bucket listing but not object reads. Without S3 data events or server access logs you can't tell which objects were taken.

Sources: [Wiz: Trusted by Default, Qubole Cross-Account Access Abused in the Wild (Nov 9, 2026)](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild)