Qubole cross-account access abused in the wild

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Customers whose AWS accounts trust Qubole integration roles

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Secrets exposed

What to do

Hunt for unexpected role assumptions from Qubole's AWS account in your AWS logs, following the hunting guidance in the Wiz blog post.

The Brief

A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
Wiz reported its observations of the activity and published guidance on how to hunt for it.

Why it matters

Customers whose AWS accounts trust Qubole integration roles may have been accessed through that trust, so unexpected role assumptions in their accounts should be checked.

The checklist behind the tier

Checklist · 3 of 10 yes

Yes	Hits tech teams	Qubole is a cloud data-platform SaaS that data and ops teams build on and run.
No	Core infrastructure	A single vendor's data platform, not software nearly every team runs.
No	Popular tool	Qubole is a niche data platform, not a widely used framework or tool.
Yes	Exploited in the wild	Wiz Blog: a threat actor was observed abusing Qubole cross-account access in the wild.
No	Public exploit	Wiz Blog describes observed activity and hunting guidance; no published exploit code is mentioned.
No	Remote, no login	Wiz Blog says the attacker used IAM credentials; no unauthenticated access is described.
No	Full takeover	Wiz Blog says the actor assumed integration roles in customer AWS environments; admin or root rights are not stated.
Yes	Secrets exposed	Wiz Blog: a threat actor used IAM credentials from Qubole's AWS account to access customer environments.
No	Supply chain	Wiz Blog describes abuse of trusted cross-account access, not malicious code shipped through a build or update channel.
No	No fix yet	Wiz Blog does not state whether Qubole has shipped a fix or mitigation.

Timeline

Nov 9
Wiz publishes report on abuse of Qubole cross-account access
Nov 9 · 2:56 PM
Wiz Blog | RSS feed
Trusted by Default: Qubole Cross-Account Access Abused in the Wild

Source

Trusted by Default: Qubole Cross-Account Access Abused in the Wild ↗ Wiz Blog | RSS feed · 3h ago

First seen 3h ago · 1 source · Full story page · How tiers are decided