---
title: Supply-chain attack through Qubole: stolen credentials from the vendor's AWS account were used to assume customer integration roles and steal secrets and S3 data, Oct 14 to 26 | ctxsec
url: https://ctxsec.com/items/wiz-qubole-cross-account-iam-roles-abused-customer-aws-secrets-s3-exfil-oct-14-26
description: "Wiz says an attacker used IAM credentials from AWS account 805246085872, which Qubole's data-lake platform uses to reach customer environments, to assume the cross-account roles customers had created for Qubole. Every AssumeRole call carried the correct External ID and succeeded, including against roles that were otherwise unused, so organizations that stopped using Qubole but never removed the trust were hit too. Once inside, the actor enumerated broadly, pulled Lambda environment variables, Secrets Manager values and SSM parameters, validated harvested AWS, Entra ID and Okta credentials with TruffleHog, and downloaded S3 data, in some cases whole buckets. Wiz also saw a separate Oct 8 to 11 wave that tested customer-owned AWS keys believed to have been created for Qubole integrations, and found a self-wiping remote-boot ISO on attacker infrastructure. Attribution and motive are unknown."
status: "research (Wiz CIRT with Sentra and Mandiant, published Nov 9, 2026); how the attacker obtained the Qubole-account IAM credentials is not disclosed; no Qubole or Idera statement found at publication"
published: 2026-11-09
---

> Wiz says an attacker used IAM credentials from AWS account 805246085872, which Qubole's data-lake platform uses to reach customer environments, to assume the cross-account roles customers had created for Qubole. Every AssumeRole call carried the correct External ID and succeeded, including against roles that were otherwise unused, so organizations that stopped using Qubole but never removed the trust were hit too. Once inside, the actor enumerated broadly, pulled Lambda environment variables, Secrets Manager values and SSM parameters, validated harvested AWS, Entra ID and Okta credentials with TruffleHog, and downloaded S3 data, in some cases whole buckets. Wiz also saw a separate Oct 8 to 11 wave that tested customer-owned AWS keys believed to have been created for Qubole integrations, and found a self-wiping remote-boot ISO on attacker infrastructure. Attribution and motive are unknown.

[← Cybersecurity News](/news) · [markdown](/items/wiz-qubole-cross-account-iam-roles-abused-customer-aws-secrets-s3-exfil-oct-14-26.md)

research (Wiz CIRT with Sentra and Mandiant, published Nov 9, 2026); how the attacker obtained the Qubole-account IAM credentials is not disclosed; no Qubole or Idera statement found at publication

2026-11-09

### Supply-chain attack through Qubole: stolen credentials from the vendor's AWS account were used to assume customer integration roles and steal secrets and S3 data, Oct 14 to 26

- **Who should look:** any organization that ever connected Qubole to AWS, even if it no longer uses it. Wiz says to review CloudTrail from Oct 1, 2026 in every account holding an integration role.
- **Why the controls didn't stop it:** the External ID isn't a secret (it's logged in plaintext in CloudTrail and often stored in infrastructure-as-code), and the trust policies named the vendor account's `:root` principal without a source-network condition. Wiz says an `aws:SourceIp` condition alone would have blocked every role assumption it observed.
- **If a role was assumed:** rotate every secret, parameter and Lambda environment variable it could read, and revoke active role sessions; rotating a credential does not end sessions already issued.
- See the companion hunt and tip items for the CloudTrail queries and trust-policy fixes.

Sources: [Wiz: Trusted by Default, Qubole Cross-Account Access Abused in the Wild (Nov 9, 2026)](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild) · [AWS IAM User Guide: access to AWS accounts owned by third parties (External ID guidance)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html)