A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.

The campaign ran between October 14 and 26, and affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated with Qubole.

Qubole is an enterprise cloud data processing and analytics platform that helps companies manage large datasets and run machine learning workloads. It also offers AWS integration to allow computing resource management.

Companies can grant third-party providers such as Qubole access to their AWS resources by creating cross-account IAM roles. Trust policies determine which external AWS accounts can take these roles, and permissions are set to define the resources and actions allowed.

Researchers at cloud security company Wiz explain that external providers use AWS’s STS AssumeRole API to obtain temporary credentials for accessing customers' resources in the cloud.

Wiz started to investigate the attack after data security and governance company Sentra shared information about suspicious activity observed in some of its customers' environments. The investigation also included cybersecurity company Mandiant.

The researchers found that the attacker had compromised two Qubole IAM users and assumed otherwise unused roles in multiple customers’ AWS accounts that had previously been configured to trust Qubole’s account, granting them access within the role’s permissions.

Wiz says the attacker then surveyed cloud resources, retrieved secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables.

They then used the TruffleHog tool to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.

Once they gained deeper access, they downloaded data from all accessible S3 buckets in the AWS environment, following an opportunistic approach rather than carefully targeting specific data.

“The sequence was consistent across environments: assume a role, call ListBuckets to see what the role could reach, call ListObjects and HeadObject to enumerate and inspect the contents, then call GetObject to download them,” Wiz explains.

The report does not specify the exact method used to compromise the Qubole accounts or the number of downstream victims. However, Sentra confirmed dozens of victims and millions of files stolen from one customer alone.

Sentra says the attacker moved quickly and collected secrets at a rate of 100 passwords and keys in seven minutes.

BleepingComputer could not find a public announcement from Qubole about this incident. We have emailed the firm for more information about the attack and await their response.

Potentially impacted administrators are advised to review CloudTrail from October 1 onward for suspicious access from Qubole’s AWS account, investigate subsequent secret and S3 access, rotate exposed credentials, and revoke active role sessions.

It is also recommended to remove unused integrations and restrict remaining roles’ permissions, trusted identities, and permitted source networks.