Security · High impactFan score 45 · Tier B
Trusted by Default: Qubole Cross-Account Access Abused in the Wild
Wiz Blog · By Zack Morrow ·
The Brief
- A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
- Wiz reported its observations of the activity and published guidance on how to hunt for it.
Why it matters
Customers whose AWS accounts trust Qubole integration roles may have been accessed through that trust, so unexpected role assumptions in their accounts should be checked.
Who’s affected
- Qubole customers with AWS integration roles
What to do
- Hunt for unexpected role assumptions from Qubole's AWS account in your AWS logs, following the hunting guidance in the Wiz blog post.
- #aws
- #iam
- #cloud-security
- #supply-chain
- #qubole
A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it.
Timeline
Wiz publishes report on abuse of Qubole cross-account access
Wiz Blog | RSS feed
Trusted by Default: Qubole Cross-Account Access Abused in the Wild