qubole

Between October 14 and October 26, 2026, an unauthorized actor successfully infiltrated the Amazon Web Services (AWS) environments of multiple customers using the Qubole data lake platform. The breach, which was first identified and detailed by the cloud security firm Wiz, allowed the attacker to gain persistent access to sensitive cloud infrastructure, harvest internal secrets, and exfiltrate vast amounts of data. The incident highlights the inherent risks associated with cross-account access policies in cloud environments, particularly when third-party service providers are granted broad, lingering permissions within client architectures.

The Mechanism of the Breach: A Failure of Trust Policies

Qubole, a prominent data lake platform now under the ownership of Idera, requires specific permissions to operate within its customers’ AWS environments. To facilitate this integration, customers typically configure an AWS Identity and Access Management (IAM) role. This role establishes a "trust relationship," allowing Qubole’s AWS account—specifically identified as 805246085872—to "AssumeRole." This action grants the platform the necessary permissions to manage data, run computations, and access resources on behalf of the customer.

In standard AWS security protocols, such cross-account access is protected by an "External ID." This is a unique, semi-static string designed to prevent the "confused deputy" problem. However, as noted in the technical analysis provided by Wiz, the External ID is not a cryptographic secret; it is an identifier that anyone with access to the role’s configuration can view. The attacker successfully leveraged valid credentials belonging to Qubole to request access to these client environments. By presenting the correct External ID, the attacker bypassed the primary gatekeeper, allowing the AWS control plane to authorize the transition.

According to researchers at Wiz, the attacker specifically targeted roles that remained active even if the customer was no longer utilizing the Qubole platform. Because these "zombie" roles still trusted the Qubole AWS account, the attacker’s requests were treated as legitimate by AWS infrastructure, granting the intruder broad read and management access to the victims’ cloud environments.

Chronology of the Incident

The threat landscape associated with this campaign appears to have unfolded in two distinct phases, suggesting a coordinated or iterative effort by the adversary.

• October 8 – October 11: The initial phase of the incident involved the abuse of static AWS access keys. In these instances, the attacker utilized customer-provisioned access keys that were originally intended for Qubole integration. This activity resulted in the compromise of several isolated cloud environments. Researchers have noted that this initial wave of activity appears distinct from the subsequent AssumeRole abuse.
• October 14 – October 26: The primary campaign began, focusing on the systemic abuse of the AssumeRole functionality. During this 12-day window, the attacker systematically queried environments linked to Qubole.
• Late October: Security researchers, including teams from Sentra, detected anomalous activity within client environments and initiated a collaborative investigation, eventually leading to the identification of the cross-account abuse pattern.

Tactics, Techniques, and Procedures (TTPs)

Once the attacker established a foothold via the AssumeRole mechanism, they moved rapidly to maximize the impact of their intrusion. Their methodology was highly automated and targeted high-value assets within the victims’ AWS accounts.

The attacker’s post-exploitation phase typically involved the following steps:

1. Credential Harvesting: The intruder scanned the environment for stored credentials. This included reading environment variables from Lambda functions, extracting secrets from the AWS Secrets Manager, and pulling values from the SSM Parameter Store.
2. Tooling Utilization: To validate the stolen credentials, the attacker employed TruffleHog, a popular open-source tool designed to detect leaked secrets. The attacker used this to test the efficacy of compromised AWS access keys, Entra ID client secrets, and Okta integration credentials.
3. Data Exfiltration: Perhaps the most significant impact was the bulk exfiltration of data from Amazon S3. The attacker did not appear to hunt for specific files; instead, they adopted a "smash and grab" approach, frequently downloading entire buckets in a single session. Because many victims lacked granular S3 data logging (or "data events" in CloudTrail), it remains difficult for security teams to determine exactly which files were accessed or stolen.

Broader Implications for Cloud Governance

This incident serves as a stark reminder of the "shared responsibility model" in cloud security. While AWS provides the infrastructure and the security tools, the configuration of IAM roles and trust policies remains the responsibility of the customer. The breach underscores three critical vulnerabilities that organizations must address:

1. The Danger of Stale Permissions
Many of the compromised accounts belonged to organizations that were no longer actively using Qubole. This "permission drift"—where access rights are left enabled long after the business need has expired—created a massive attack surface. Organizations must implement automated lifecycle management for IAM roles to ensure that third-party access is revoked immediately upon the termination of a service agreement.

2. The Misconception of the External ID
The reliance on External IDs as a primary security control is a frequent point of failure. As noted by AWS documentation, the External ID is meant to prevent a third party from tricking a service into accessing a customer’s resource, but it is not a substitute for robust, least-privilege access policies. Organizations often treat these IDs as passwords, which they are not.

3. Monitoring and Visibility Gaps
The investigation was hampered by a lack of logging. While AWS CloudTrail provides management-level logs (such as the AssumeRole request itself), it does not provide object-level visibility for S3 buckets unless S3 Data Events are explicitly enabled. Many of the victims in this breach lacked the requisite logging, meaning the full scope of the data exfiltration will likely never be known.

Recommendations for Remediation

Wiz and other industry analysts have provided a set of hardening recommendations for any organization that has utilized Qubole or similar third-party integrations:

• Log Audit: Organizations should review all CloudTrail logs dating back to October 1. Specifically, they must look for any AssumeRole events originating from the AWS account ID 805246085872 that originated from an IP address outside of the expected AWS infrastructure.
• Access Review: Immediately audit all IAM roles that grant cross-account access. Any roles that are not strictly necessary for current business operations should be deleted.
• Policy Refinement: Implement restrictive IAM policies that limit the scope of what an assumed role can perform. If a role only needs to read from a specific S3 bucket, the permissions should be restricted to that resource, rather than granting broad access to the entire account.
• Secret Rotation: If an organization suspects that their environment was accessed, they must assume that all secrets within that environment—including API keys, database credentials, and third-party tokens—have been compromised. A full rotation of all secrets is the only path to restoring trust in the environment.

Industry Response and Current Status

As of early November 2026, neither Qubole nor its parent company, Idera, have released a comprehensive public statement regarding the breach. The lack of a formal acknowledgment has caused concern within the security community, as affected customers are currently left to manage their own incident response and forensic investigations without direct guidance from the platform provider.

The targeting profile observed in this incident is notable for its lack of sophistication compared to state-sponsored Advanced Persistent Threats (APTs). The attacker’s reliance on broad data exfiltration and automated secret testing suggests a financially motivated actor, likely focused on maximizing the immediate value of the stolen data rather than maintaining a long-term espionage presence.

Ultimately, the Qubole breach serves as a cautionary tale for the enterprise cloud ecosystem. As organizations continue to rely on a complex web of third-party SaaS integrations, the management of cross-account access policies becomes as critical as the protection of the perimeter itself. Security teams must prioritize visibility, aggressive pruning of unused permissions, and the implementation of robust, data-level logging to ensure that if a breach occurs, the blast radius can be contained and analyzed before irreparable damage is done.