1. Basic Information

2. Executive Summary

Attackers who obtained credentials for IAM users belonging to Qubole's AWS account used remaining cross-account trust on the customer side to assume roles, collect secrets from Lambda environment variables, Secrets Manager, and SSM Parameter Store, and exfiltrate S3 data.

3. Attack Flow

  1. The attackers used credentials for two IAM users in Qubole's AWS account.
  2. The attackers successfully executed sts:AssumeRole into customer-side Qubole integration roles using an External ID.
  3. They used session names such as quiam-enum to enumerate storage, compute, database, IAM, and KMS.
  4. They retrieved secrets from Lambda environment variables, Secrets Manager, and SSM Parameter Store, and used TruffleHog to validate AWS, Entra ID, and Okta credentials.
  5. They enumerated S3 buckets and downloaded data using GetObject.

4. Attacker Position and Execution Location

  • External attackers holding valid credentials for the Qubole vendor account, assuming customer AWS roles from a VPN or VPS.

5. Visibility for Victims and Administrators

Victim Side

  • Not immediately visible to regular users; may be discovered later as credential abuse or data leakage.

Administrator Side

  • Visible in CloudTrail as AssumeRole actions, secret retrieval, S3 object reads, TruffleHog user-agents, and vendor principal usage from unfamiliar networks.

6. Success and Failure Conditions

Success Conditions

  • The customer AWS account trust policy permits the Qubole account, and the integration role and External ID are valid.
  • The role possesses permissions to reach secrets and S3 data.

Failure Conditions and Countermeasures

  • Delete unused vendor roles and trust relationships, restricting trusted principals, source IPs, and VPC endpoints.
  • Apply the principle of least privilege to roles, perform secret rotation, and revoke and contain issued role sessions.
  • (Measures for detection and post-incident investigation) Enable CloudTrail data events or S3 access logs for sensitive buckets. This does not block reads by itself.

7. What Happens Upon Success

  • Acquisition of configuration, secrets, and credentials across multiple customer AWS environments.
  • Exfiltration of S3 objects.
  • Subsequent access to AWS, Entra ID, and Okta using the acquired credentials.

8. Observable Logs

  • Email: No specific observation points published for this incident.
  • Proxy/SWG/DNS: The attack involved access to AWS APIs from outside the victim organizations; the published reports do not identify observable traffic passing through their proxies or SWGs. Check CloudTrail for source IP addresses associated with OVH or Mullvad and the main records of API activity.
  • Endpoint/EDR: Lambda configuration retrieval involves API operations like GetFunctionConfiguration without executing code inside the functions. Traces on the workload side are candidates for follow-up investigation if the acquired credentials were used subsequently.
  • Identity/IdP: Sign-ins where Entra ID service principals and Okta OAuth credentials were verified using the TruffleHog user-agent.
  • SaaS/Cloud: AssumeRole from account 805246085872, quiam-* sessions, GetSecretValue, GetParameter, GetFunctionConfiguration, and GetObject.
  • Network: 45.83.220[.]211, 57.129.54[.]120, 185.209.199[.]73, etc. VPN exit nodes alone are not definitive.

9. Attack Success Determination

Information Theft or Session Compromise Confirmed

  • Published Information: Wiz and Sentra confirmed role assumption, secret retrieval, and S3 exfiltration in multiple customer AWS environments.
  • Scope of Confirmation: The observation scope of the victim environments investigated by both companies.

10. Investigation Playbook

  • Trigger: Triggered by AssumeRole from the Qubole account via non-AWS networks, quiam-* sessions, and the TruffleHog user-agent.
  • Initial Verification: Check CloudTrail for principal IDs, source IPs, and role sessions across all accounts and regions from 2026-10-01 onward.
  • Endpoint: Preserve workloads and Lambda configurations that utilize the acquired secrets.
  • Authentication & Cloud: Track the use of the same user-agent, IOCs, and service principals across AWS, Entra ID, and Okta.
  • Subsequent Actions: Investigate secret access, S3 object reads, and access to additional accounts for each role session.
  • Containment: Remove trust relationships, rotate secrets, revoke active sessions, block IOCs, and reduce permissions.
  • Determination Categories: Differentiate role assumption, secret retrieval, credential verification, S3 exfiltration, and subsequent compromise.

11. Defense and Detection Ideas

  • Single Event: Detect AssumeRole requests from the Qubole principal via new networks with high priority.
  • Time-Series Correlation: Correlate AssumeRole -> enumeration -> secret retrieval -> TruffleHog verification -> S3 GetObject.
  • Hunting: Search for account 805246085872, principal IDs (noting AIDA3W7DIFLYOLTK63SFS was used exclusively for attacker activity in Wiz's observed environments, whereas AIDAJYRRH5Y3A7AAJM2HW is also used for legitimate traffic, requiring combination with non-AWS source conditions), quiam-* sessions, and IOC IPs.
  • Log Limitations: CloudTrail management events alone cannot verify S3 object reads; data events or access logs are required.
  • Priority Controls: Prioritize removing unused vendor trust, setting source conditions, applying least privilege, enabling organization-wide logs, and revoking secrets.

12. Facts / Inference / Hypothesis

Facts

  • Between October 14 and October 26, 2026, IAM users in the AWS account used by Qubole were observed successfully assuming customer integration roles.
  • Every AssumeRole request that Wiz observed and attributed to the threat actor included an External ID and succeeded.
  • Attackers retrieved secrets from Lambda environment variables, Secrets Manager, and SSM Parameter Store, and validated additional credentials using TruffleHog.
  • In S3, data was retrieved in the order of ListBuckets, ListObjects, HeadObject, and GetObject, with entire buckets downloaded in some environments.
  • Wiz has not confirmed the deployment of the separately discovered sso_agent.iso to victim environments.

Inference

  • External IDs alone are not a sufficient security control, and standing trust that does not restrict vendor principals and source networks expands the blast radius of supply chain attacks.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1078.004 Valid Accounts: Cloud Accounts high Assumed customer roles using valid credentials of vendor IAM users.
T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores high Retrieved credentials using Secrets Manager GetSecretValue and SSM Parameter Store GetParameter.
T1530 Data from Cloud Storage high Data exfiltration confirmed via S3 GetObject.

14. Unknowns and Further Investigation

  • The specific initial vector for Qubole credential theft, the total number of victim organizations, and the ultimate intended use of the acquired data have not been publicly disclosed.

15. Impact on SOCs and Organizations

Cross-account roles granted to SaaS and data platforms tend to persist for long periods, meaning vendor account compromises can directly lead to internal cloud breaches. Organizations should not only check for Qubole usage but also audit all external account trust relationships, verify source conditions, and ensure data event logging is enabled.

16. Summary by Role

  • For SOCs: Track Qubole principal AssumeRole, secret access, and S3 access in chronological order.
  • For Administrators: Remove unused trust relationships, enforce source conditions, apply least privilege, and execute secret revocation.
  • For Users: This attack does not require direct interaction by regular users. Follow credential reset instructions for the affected services.