Wiz Researchers Reveal Active Exploitation of Qubole Cross-Account Access Leading to Compromised AWS Environments

Between October 14 and October 26, malicious actors successfully infiltrated Amazon Web Services (AWS) accounts belonging to multiple enterprise clients of the data lake platform Qubole, exfiltrating sensitive credentials and proprietary data. The breach, which was uncovered and publicly disclosed by cloud security firm Wiz, highlights the growing attack surface presented by third-party vendor integrations in modern cloud-native infrastructures. Security researchers noted that the intrusion vector leveraged administrative credentials linked to Qubole’s service accounts, though the precise mechanism by which the initial access was compromised remains under active investigation.

The incident impacts organizations utilizing or formerly utilizing Qubole, a prominent big data platform owned by software parent company Idera. Because Qubole operates directly within customer cloud perimeters to manage complex data analytics pipelines, it requires deep integration privileges. The ongoing forensic analysis underscores the critical need for continuous monitoring of third-party access channels, identity governance, and strict adherence to the principle of least privilege across enterprise cloud ecosystems.

Mechanics of the Breach: How Cross-Account Access Was Abused

To function efficiently inside a customer’s cloud ecosystem, Qubole typically relies on an AWS Identity and Access Management (IAM) role. In this configuration, the client creates a specific IAM role within their environment, equipped with a trust policy that permits Qubole’s dedicated administrative AWS account to assume that role.

Under AWS architecture, when an external service attempts to assume a role via the AssumeRole API call, it must supply both the trusted account identifier and an External ID—a unique cryptographic token assigned by the client to prevent the "confused deputy" problem. During the mid-October attacks, Wiz researchers discovered that the malicious actor systematically executed AssumeRole requests carrying valid External IDs associated with targeted Qubole customers.

Significantly, a large proportion of the IAM roles targeted by the attacker were dormant, belonging to organizations that had previously integrated Qubole but were no longer actively utilizing the service. Because these legacy trust relationships had not been explicitly revoked or cleaned up, they remained active conduits. The adversary utilized Qubole’s official platform AWS account identifier (805246085872) as the vehicle for these requests, launching them from external IP addresses completely outside of the authorized AWS infrastructure boundaries.

Detailed Timeline and Chronology of the Exploitation Campaign

The malicious activity observed by cloud security monitoring tools unfolded across two distinct operational phases throughout the month of October 2026:

• Early October Reconnaissance and Access (October 8 – October 11): Initial indicators of compromise identified by security analysts revealed threat actors leveraging static AWS access keys that customers had previously generated specifically for Qubole integrations. During this four-day window, attackers used these stolen keys to breach a select group of cloud environments.
• Mid-October Cross-Account Abuse (October 14 – October 26): The primary campaign shifted toward automated AssumeRole abuse. Over a nearly two-week period, attackers systematically targeted Qubole client accounts, scouring environments for stored secrets, configuration parameters, and accessible storage buckets.
• Detection and Alerting (Late October): Cloud monitoring platform Sentra first identified anomalous API behavior across multiple shared client environments and immediately alerted Wiz researchers, triggering a broader industry investigation into the third-party vector.
• Public Disclosure (November 9, 2026): Wiz released comprehensive technical documentation and threat-hunting guidelines, warning organizations with historical or active Qubole integrations to audit their CloudTrail logs immediately.

Scope of Exfiltration and Attack Methodology

Once inside the compromised AWS environments, the threat actors executed a disciplined and automated discovery phase designed to maximize credential harvesting and data theft. According to technical findings from Wiz, the operations included:

1. Credential Harvesting: The attacker systematically swept the environment for high-value secrets. This included reading plaintext environment variables embedded within AWS Lambda functions, pulling sensitive credentials directly from AWS Secrets Manager, and extracting configuration parameters out of the SSM Parameter Store.
2. Automated Credential Testing: To determine the operational validity of the harvested secrets, the adversary fed the recovered data—including organizational AWS access keys, Microsoft Entra ID client secrets, and Okta administrator credentials—into TruffleHog, an open-source credential scanning tool. This allowed the actors to immediately validate which keys granted lateral movement or administrative privileges.
3. Data Exfiltration from S3: Unlike targeted corporate espionage campaigns that search for specific proprietary datasets, this adversary adopted a broad, opportunistic approach. The malicious actors systematically copied data from any Amazon S3 bucket accessible via the assumed IAM roles, in some instances executing bulk downloads of entire storage buckets within a single continuous session.

Security analysts noted that the operational signature and targeting methodology of this campaign do not align with known Advanced Persistent Threat (APT) groups or state-backed cyberespionage units, pointing instead to financially motivated cybercriminals specializing in cloud data extortion.

Impact on Incident Response and Log Visibility

A significant challenge faced by cybersecurity incident responders investigating the Qubole breaches has been a lack of granular log data among affected victims. While AWS CloudTrail management events successfully captured the initial AssumeRole API invocations and broad S3 bucket listings, standard management logs do not record which specific objects within an S3 bucket were read or downloaded by an identity.

Determining the precise scope of data theft requires enabling S3 data events or comprehensive S3 server access logs. Because numerous victim organizations had not enabled these auxiliary logging features, forensic teams were left with significant blind spots, unable to definitively ascertain whether proprietary customer data, intellectual property, or personally identifiable information (PII) was exfiltrated during the sessions.

Remediation and Defensive Recommendations for Cloud Administrators

In response to the active exploitation campaign, cloud security experts have outlined rigorous remediation steps for any organization that has ever established a Qubole integration within their AWS architecture:

• Audit Historical CloudTrail Logs: Security teams should immediately review all AWS CloudTrail logs dating back to October 1, searching specifically for AssumeRole requests originating from the Qubole service account (ID: 805246085872) that emanate from non-AWS IP addresses.
• Review Suspicious Sessions: For every identified anomalous session, administrators must conduct a deep-dive forensic review of subsequent API activity, focusing heavily on read and export actions within AWS Secrets Manager, SSM Parameter Store, Lambda function configurations, and S3 storage buckets.
• Revoke Unused Third-Party Trust Relationships: Organizations must adopt a zero-trust posture regarding third-party vendor access. Any IAM roles, trust policies, or static access keys created for legacy integrations—such as Qubole—that are no longer actively required should be deleted immediately.
• Enforce Enhanced Logging: Cloud architects are urged to enable S3 data events and granular object-level logging across all sensitive storage buckets to ensure complete visibility during future forensic investigations.

As of the time of publication, neither Qubole nor its parent company Idera had issued a formal public statement regarding the security incident on their respective corporate websites. Cybersecurity professionals emphasize that the event serves as a stark reminder of the inherent risks associated with third-party software supply chains, third-party IAM cross-account privileges, and the critical necessity of lifecycle management for cloud credentials.