Qubole AWS IAM Breach 2026: How Trusted Cloud Access Became an Attack Vector
Executive Summary
Executive Summary Between October 14 and October 26, 2026, an unknown threat actor abused compromised credentials tied to Qubole's AWS account (ID: 805246085872) to execute cross-account AssumeRole attacks against multiple Qubole customers. The attacker leveraged valid External IDs—visible in CloudTrail logs and infrastructure-as-code files—to assume IAM roles originally provisioned for Qubole's data lake platform, even in accounts where Qubole was no longer actively used. Once inside, the attacker harvested Lambda environment variables, Secrets Manager entries, SSM Parameter Store values, Okta and Entra ID credentials, and exfiltrated entire S3 buckets. A separate but related campaign from October 8–11 abused static AWS access keys configured for Qubole. The incident underscores how dormant third-party IAM roles with overly broad permissions create persistent, exploitable trust relationships across cloud environments.
This attack exemplifies the accelerating threat of supply-chain credential abuse in multi-tenant cloud platforms. As enterprises deepen reliance on SaaS data platforms with deep AWS integration, the attack surface of inherited trust relationships expands dramatically—making third-party IAM hygiene and cross-account visibility critical priorities for cloud security programs in 2026 and beyond.
Why This Matters Now
Why This Matters NowCloud supply-chain attacks exploiting trusted IAM roles are surging in 2026, with attackers increasingly targeting vendor-managed credentials to bypass perimeter controls entirely. Regulatory frameworks including NIST CSF 2.0 and PCI DSS 4.0 now explicitly require third-party access governance and continuous monitoring, raising compliance stakes for any organization using SaaS platforms with AWS integration.
Attack Path Analysis
Attack Path AnalysisAn attacker obtained Qubole's AWS account credentials (account 805246085872) through an undisclosed method, then leveraged the trusted cross-account IAM role mechanism — including valid External IDs visible in CloudTrail — to assume roles across multiple customer AWS accounts without authorization. Once inside each account, the attacker escalated access by enumerating and harvesting secrets from Lambda environment variables, Secrets Manager, and SSM Parameter Store, then validated stolen credentials using TruffleHog before performing broad S3 bucket exfiltration, ultimately compromising downstream identity providers including Entra ID and Okta and causing significant data theft across the victim organizations.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker obtained valid credentials for Qubole's AWS platform account (805246085872) through an undisclosed vector — likely credential theft, insider access, or a prior breach of Qubole's own infrastructure. This gave the attacker a trusted identity within AWS's cross-account trust fabric, from which all subsequent abuse was possible. The attacker operated from OVH-hosted IPs and Mullvad VPN addresses, indicating deliberate operational security to obscure origin.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesTrusted Relationship
Valid Accounts: Cloud Accounts
Unsecured Credentials: Cloud Instance Metadata API
Data from Cloud Storage
Credentials from Password Stores
Cloud Storage Object Discovery
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Obtain Capabilities: Digital Certificates
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Information Sharing, Remote Access, and Service Identification and Authentication
Control ID: AC-21, AC-17, IA-9
PCI DSS 4.0 – Least Privilege Access, Multi-Factor Authentication, and Third-Party Service Provider Management
Control ID: Requirement 7.2, Requirement 8.3, Requirement 12.8
NYDFS 23 NYCRR 500 – Third-Party Service Provider Security, Training and Monitoring, Access Privileges
Control ID: 500.11, 500.14, 500.07
DORA (Digital Operational Resilience Act) - EU 2022/2554 – ICT Third-Party Risk Management and Contractual Arrangements
Control ID: Article 28, Article 30
NIS2 Directive (EU 2022/2555) – Supply Chain Security and Access Control Measures
Control ID: Article 21(2)(d), Article 21(2)(f)
CISA Zero Trust Maturity Model 2.0 – Least Privilege Identity Enforcement and Network-Based Access Conditions
Control ID: Identity Pillar - Advanced Stage, Network Pillar - Advanced Stage
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Supply-chain cloud credential abuse via Qubole's trusted AWS IAM roles exposes IT organizations to lateral movement, secrets exfiltration from Lambda and Secrets Manager, and cascading multi-cloud compromise requiring Zero Trust Segmentation and egress controls.
Financial Services
Stolen Okta and Entra ID client secrets plus AWS access keys harvested via TruffleHog place financial services firms at critical PCI 4.0 and NIST 800-53 compliance risk, enabling unauthorized data exfiltration and credential-chain compromise across cloud environments.
Health Care / Life Sciences
Broad S3 bucket exfiltration and Secrets Manager exposure during the Qubole AWS AssumeRole abuse directly threatens HIPAA 164.312 data-in-transit and access control mandates, with undetected lateral movement amplifying protected health information breach liability.
Cloud Computing
Trusted third-party IAM role abuse exploiting misconfigured External ID controls and over-permissioned vendor policies underscores critical multicloud visibility gaps, demanding Aviatrix-class egress enforcement, anomaly detection, and organization-wide CloudTrail logging to contain supply-chain intrusions.
Sources
Sources- Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Datahttps://thehackernews.com/2026/11/hackers-exploit-quboles-trusted-aws.htmlVerified
- Qubole Cross-Account Access Abused in the Wild - Wiz Researchhttps://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wildVerified
- AWS IAM: How to use an external ID when granting access to your AWS resources to a third partyhttps://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.htmlVerified
- Qubole IAM Roles Setup Guidehttps://docs.qubole.com/en/latest/user-guide/managing-accounts/aws/iam-roles/create-iam-roles.htmlVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker exploited trusted cross-account IAM relationships and moved freely across AWS services and accounts without network-layer friction. By enforcing segmented, identity-aware access boundaries and controlled egress paths, CNSF would likely have reduced the attacker's reachability across customer accounts and constrained the blast radius of the initial credential compromise.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network-layer segmentation enforced by CNSF would likely constrain the attacker's ability to freely reach internal AWS workloads and service endpoints from anonymized external infrastructure, reducing the reachability of compromised credentials across cloud environments.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely reduce the scope of privilege escalation by limiting which workloads and service endpoints a newly assumed role identity can reach within a segmented cloud environment, constraining how broadly elevated permissions could be exercised across customer accounts.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to freely traverse between AWS services and accounts, reducing the number of reachable workloads and limiting how far lateral movement could propagate across the customer account landscape.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely surface anomalous API call patterns and unrecognized external IP origins within monitored traffic flows, potentially reducing the attacker's ability to blend command-and-control activity into legitimate automation without generating observable behavioral signals.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely constrain bulk data transfer paths out of the environment, reducing the volume and reach of S3 exfiltration by limiting which external destinations cloud workloads and assumed role sessions are permitted to communicate with.
Had prior CNSF controls constrained lateral movement and egress paths, the residual impact would likely have been reduced in scope — with fewer customer accounts reachable, fewer secrets exposed across segmented workloads, and downstream identity systems such as Entra ID and Okta less likely to be compromised from credentials harvested within a more tightly bounded blast radius.
Impact at a Glance
Affected Business Functions
- Cloud Data Lake Analytics and Processing (Qubole/AWS)
- Secrets and Credential Management (AWS Secrets Manager, SSM Parameter Store, Lambda)
- Cloud Object Storage and Data Access (AWS S3)
- Identity and Access Management (AWS IAM, Entra ID, Okta)
Estimated downtime: 12 days
Estimated loss: N/A
Multiple Qubole customers experienced unauthorized access to AWS environments between October 8 and October 26. Exposed assets include: AWS access keys and IAM credentials retrieved from Lambda environment variables; secrets stored in AWS Secrets Manager; parameters from SSM Parameter Store including plaintext credentials; Entra ID (Azure AD) client secrets; Okta client credentials; and bulk S3 bucket contents including potentially entire buckets exfiltrated in single sessions. The attacker validated stolen credentials using TruffleHog, confirming active credential harvesting. Victims spanned multiple organizations, and several lacked sufficient logging (S3 data events) to determine the full scope of object-level data accessed. The nature of data lake environments means exposed S3 buckets likely contained sensitive business data, analytics datasets, and possibly regulated information such as PII or financial records depending on individual customer configurations. Financial loss is undetermined and set to 0 pending official disclosure from Qubole or Idera; actual costs from breach response, credential rotation, and potential regulatory exposure are expected to be significant.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce Zero Trust Segmentation on vendor IAM roles: Apply identity-based, least-privilege policies (ZTMM.Network, NIST.800-53.AC-6) to all third-party cross-account roles — restrict trust policy principals to specific IAM entities rather than account-wide :root, and add aws:SourceIp or aws:SourceVpce conditions so that AssumeRole requests from unapproved IPs (e.g., VPN or hosting provider ranges not used by the vendor) are denied at the policy layer, which Wiz confirmed would have blocked every observed role assumption.
- • Deploy Multicloud Visibility & Control for anomalous API behavior: Leverage centralized control plane observability (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to baseline and alert on AssumeRole patterns from vendor accounts — unusual source IPs, off-hours access, session names matching attacker-created patterns (quiam-*), or TruffleHog user agents on GetCallerIdentity calls should trigger automated detection and response workflows.
- • Apply Egress Security & Policy Enforcement to block unauthorized data outbound flows: Implement FQDN-based egress filtering and outbound traffic policy enforcement (ZTMM.Data, NIST.800-53.SC-18, NIST.CSF.PR.DS-5) to detect and block bulk S3 data transfers or credential-testing traffic destined for non-approved external endpoints, particularly from assumed-role sessions with anomalous access patterns.
- • Enable Encrypted Traffic (HPE) protections and enforce data-in-transit controls: While the primary attack vector was credential abuse rather than packet sniffing, ensuring all data exfiltrated via S3 or secrets APIs traverses encrypted, policy-enforced paths (ZTMM.Data, NIST.CSF.PR.DS-2) limits attacker visibility into harvested credential values and reduces risk of secondary interception on unencrypted circuits used by Qubole's platform integrations.
- • Deploy East-West Traffic Security controls to contain cross-account lateral movement: Implement workload-to-workload segmentation policies (ZTMM.Network, NIST.800-53.SC-7) that enforce strict service-to-service authorization between vendor-assumed roles and sensitive AWS services (Lambda, Secrets Manager, SSM, S3) — preventing a single compromised vendor identity from enumerating and accessing all services across an account without additional per-service authorization checks.
