Attackers Abuse Qubole Cross-Account Access to Breach Customer AWS Environments
Do Son 
TL;DR
Between October 14 and October 26, 2026, a threat actor abused Qubole cross-account access to infiltrate multiple customer AWS environments. By using compromised IAM credentials from Qubole’s vendor account, the intruder assumed trusted customer roles to steal secrets and download Amazon S3 buckets. Furthermore, many victims were breached through dormant Qubole AWS cross-account access roles that remained enabled long after organizations stopped using the platform.
What Happened in the Supply Chain Attack
Data processing platforms frequently rely on cross-account IAM roles and External IDs to manage resources inside customer cloud accounts. According to a joint investigation into Qubole cross-account access abuse by Wiz, Sentra, and Mandiant, Sentra first spotted suspicious activity across several customer environments and alerted Wiz. Specifically, starting on October 14, an attacker operating from a Mullvad VPN IP address (45.83.220.211) called sts:AssumeRole from Qubole’s AWS account (805246085872) using the IAM user AIDA3W7DIFLYOLTK63SFS.
From October 15 onward, most malicious requests originated from an OVH virtual private server (57.129.54.120) and a second Mullvad node (185.209.199.73). On October 18, the intruder also began abusing a second Qubole IAM user (AIDAJYRRH5Y3A7AAJM2HW). “Every AssumeRole request we attributed to the threat actor included an External ID, and every one succeeded,” Wiz researchers wrote. Using role session names prefixed with quiam-, such as quiam-enum and quiam-scope-full, the intruder mapped storage, compute, and database services. Separately, researchers observed an unlinked campaign between October 8 and October 11 where an actor tested customer-owned AWS keys created for Qubole integrations.
Credential Harvesting and S3 Data Theft
After assuming the integration roles, the attacker extracted credentials from AWS Secrets Manager, SSM Parameter Store, and Lambda function environment variables. Next, the intruder used the open-source tool TruffleHog to validate stolen keys against AWS, Microsoft Entra ID, and Okta.
Additionally, using Validin telemetry, Wiz found a bootable Linux image named sso_agent.iso hosted on the attacker’s OVH server. This image loads the ntfs3 driver to target Windows disks, runs shell scripts over TCP port 23458, and triggers a hard reboot after 90 minutes to wipe forensic traces.
Who Is Behind the Activity
Wiz has not linked this operation to any known threat group, noting that the opportunistic data theft does not match typical state-sponsored priorities. However, on November 11, 2026, journalist Catalin Cimpanu of the Risky Business newsletter reported that an actor using the handle “non” claimed responsibility for the breach. Attribution remains unconfirmed while investigations continue.
Impact and Dormant Role Exposure
Once inside victim networks, the attacker listed reachable S3 buckets and downloaded entire buckets during single sessions. Notably, most of the abused Qubole cross-account access roles were completely inactive prior to the intrusion. “In a majority of the environments Wiz CIRT observed, the threat actor’s requests were the only AssumeRole activity from the vendor account in October. The trust policies were still in place, so the requests succeeded,” the report noted.
How Organizations Can Stay Protected
To defend against Qubole AWS cross-account access abuse, cloud administrators should immediately remove any unused or legacy third-party IAM trust relationships. Security teams must review AWS CloudTrail logs from October 1, 2026 onward for AssumeRole calls from account 805246085872 originating outside AWS IP ranges, as well as any activity involving user AIDA3W7DIFLYOLTK63SFS or TruffleHog user agents. Finally, affected organizations must revoke active role sessions and rotate all secrets, parameters, and Lambda variables accessible to compromised Qubole roles.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
