Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets

Hackers abused trusted Qubole integrations to enter customer AWS accounts, steal secrets, and download data from Amazon S3, sometimes taking entire buckets in one session.

The activity ran from October 14 through October 26, 2026, using IAM credentials from an AWS account associated with Qubole rather than exploiting a software vulnerability.

The attackers relied on permissions customers had granted to the data processing platform. Roles created for legitimate business needs remained accessible even when integrations were no longer active.

The case highlights why cloud identity access management requires regular reviews of both permissions and external trust relationships, not simply checks on whether an integration still works.

Researchers from Wiz.io, working with Sentra and Mandiant, investigated the campaign after Sentra detected suspicious activity across customer environments.

Wiz also identified a malicious bootable Linux image hosted on attacker infrastructure, but could not confirm its deployment or use. Its published technical investigation separates that discovery from the confirmed cloud intrusions.

Hackers Exploit Trusted Qubole IAM Roles

Qubole integrations use cross-account IAM roles to operate inside customer environments. A customer creates a role whose trust policy permits the vendor’s AWS account to assume it, typically with an External ID.

AWS Security Token Service then issues temporary credentials limited to that role’s permissions. The attacker followed this legitimate access path. Initial requests came through Mullvad VPN, followed by activity mainly from an OVH-hosted server.

Every role-assumption request attributed to the attacker included an External ID and succeeded. Most compromised roles were otherwise unused, yet their trust policies continued accepting requests.

After gaining access, the attacker mapped storage, compute, databases, identities, and encryption keys. It inspected Lambda function configurations for environment variables, retrieved Secrets Manager values, and read Systems Manager Parameter Store entries.

These locations can hold credentials that extend access beyond the original integration role. The attacker then used TruffleHog to validate discovered credentials across AWS, Microsoft Entra ID, and Okta.

Similar AWS credential validation techniques have appeared in other cloud intrusions, although Wiz found no established connection between this campaign and previously reported activity. TruffleHog itself is a legitimate security tool.

S3 theft followed a repeatable sequence: list available buckets, enumerate objects, inspect object metadata, and download files.

The attacker appeared opportunistic, reading whichever buckets each role could reach rather than pursuing a clearly defined dataset. In some environments, this meant downloading complete buckets during a single session.

Detection, Containment, and Third-Party Trust Hardening

Wiz recommends reviewing CloudTrail records from October 1, 2026, onward across every account holding a Qubole integration role.

Investigators should correlate role assumptions with source networks, principal identities, and subsequent secret or storage access.

Legitimate Qubole traffic observed during the investigation originated from AWS infrastructure, making unexpected external networks especially useful hunting signals.

Logging coverage matters. CloudTrail management events show role assumptions and bucket listings, but not the object reads responsible for data theft.

Sensitive buckets therefore need S3 data events or server access logs. Separately reported rapid AWS account compromises reinforce the importance of investigating credential abuse before attackers expand access.

If an integration role was abused, revoke its active sessions and rotate every accessible secret, parameter, and credential-bearing Lambda variable.

Credential rotation alone does not invalidate temporary sessions already issued. Remove unused integrations, restrict trusted principals and source networks, and reduce permissions to the resources each vendor actually needs.

External IDs should not be treated as passwords: they appear in plaintext logs and may exist in vendor systems or infrastructure code.

Wiz also reported separate customer-owned key abuse during October 8–11, but could not link it to this campaign. Neither the attacker’s identity nor its plans for stolen data were established.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets appeared first on Cyber Security News.