616/69 Thuesday, November 10, 2026
Cloud security company Wiz disclosed that threat actors gained access to Amazon Web Services (AWS) accounts belonging to organizations that had used Qubole, a big data management platform, between October 14 and 26, 2026, in order to steal sensitive data and secrets stored in those environments. The attackers abused AWS credentials associated with Qubole’s account that had been trusted to connect to customer environments. The activity was first detected by Sentra across several customer environments before Wiz researchers were brought in to investigate. In many cases, the attackers assumed IAM roles that customers had previously configured for Qubole but were no longer actively using, while the associated trust policies remained in place, leaving a path for continued access.
In the observed attacks, the threat actors issued AssumeRole requests from Qubole’s AWS account and supplied valid External IDs, causing AWS to grant access according to the existing trust configuration. External IDs are not treated as secrets and may be visible to users with permission to inspect the role configuration. Once inside the environment, the attackers searched for credentials and secrets stored across cloud resources, then tested items such as AWS access keys, Entra ID client secrets, and Okta client credentials using TruffleHog. The attackers also copied data from every S3 bucket accessible to the compromised role and, in some cases, downloaded entire buckets in a single session. Separately, another incident observed between October 8 and 11 involved AWS access keys belonging to customers, believed to have been created for Qubole integrations, being used to directly access cloud environments. Researchers have not confirmed a connection between that activity and the AssumeRole attacks.
Organizations that previously integrated their AWS environments with Qubole should review CloudTrail logs dating back to October 1, 2026, and look for AssumeRole requests originating from AWS account 805246085872 and external IP addresses outside AWS infrastructure. If suspicious activity is identified, organizations should rotate all access keys and secrets available to the affected role and immediately revoke any active sessions. Administrators should also remove unused third-party IAM roles and tighten cross-account access controls, such as restricting trusted source IP addresses or applying network-based conditions, to reduce the risk of attackers abusing lingering trust relationships in the future.
Source: https://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.html