Over a dozen organizations have been hit by a sophisticated supply chain attack that leveraged compromised credentials for big-data platform Qubole’s Amazon Web Services (AWS) account. The attackers used these credentials to assume IAM roles set up by customers, allowing them to access and steal data from the AWS environments of multiple companies.
The threat actor exploited a common practice in software-as-a-service (SaaS) platforms like Qubole, which operate within customers’ AWS environments. During onboarding, customers create an IAM role for Qubole’s AWS account, which can assume this role when needed to access customer data. The leaked credentials allowed the attackers to assume these roles and pull data from the affected companies’ AWS environments.
According to cybersecurity firm Sentra, the doors used by the attacker were old ones – Qubole roles were still in place long after companies had stopped using Qubole’s services, and these roles could read nearly all of the data the attackers went after. The campaign kicked off on October 14 and continued until October 26, with the attackers using role session names that followed a consistent format to enumerate resources, collect secrets and configurations, and access data.
The attacks originated from a rented OVH server and the Mullvad VPN, and none of the observed activity came from Qubole’s network. The threat actor appears to have been opportunistic, rather than targeting specific data or companies. They read from whatever buckets each role could reach, in some cases downloading entire buckets in a single session.
Cybersecurity firm Wiz analyzed the campaign alongside Sentra and discovered an ISO file designed to be remotely booted on victim machines to harvest data, but has no evidence of its deployment. Wiz also identified a separate campaign involving Qubole integrations, active between October 8 and October 11, in which customer-owned AWS access keys were tested against victim environments.
This attack highlights the importance of regularly reviewing and updating IAM roles and permissions, especially for SaaS platforms that operate within customers’ AWS environments. It also underscores the need for organizations to monitor their AWS environments closely and detect any suspicious activity in a timely manner. By taking proactive steps to secure their AWS accounts, companies can mitigate the risk of supply chain attacks like this one.
As a precautionary measure, organizations should review their IAM roles and permissions, especially those related to SaaS platforms operating within their AWS environments. They should also ensure that their AWS accounts are properly configured and up-to-date with the latest security patches. By staying vigilant and proactive in securing their cloud infrastructure, companies can protect themselves against supply chain attacks like this one.
Source: SecurityWeek — 2026-11-10