Attackers use data platform Qubole’s AWS access to steal secrets, Wiz says
- Vendor
- Qubole
Attackers used identity and access management (IAM) credentials from an AWS account tied to Qubole, a cloud data processing platform, Wiz says. With them, they assumed the roles customers had set up to trust Qubole, then collected secrets, tested the credentials they found and downloaded S3 data. Wiz, working with Sentra and Mandiant, saw the activity in multiple customer environments from Oct 14 to Oct 26 and published hunting queries and indicators.
Platforms like Qubole work inside a customer’s AWS account through a role the customer creates. Its trust policy lets the vendor’s account assume the role, usually gated by an External ID. Every role assumption Wiz tied to the attacker carried a valid External ID and succeeded. The attacker then read Lambda environment variables, Secrets Manager and SSM Parameter Store, and used TruffleHog to test AWS keys, Entra ID client secrets and Okta client credentials it found.
In most of the environments Wiz saw, the attacker’s calls were the only role assumptions from Qubole’s account in October. Most of the roles weren’t otherwise in use, yet their trust policies still accepted the attacker’s requests. The attacker read whatever buckets each role could reach, sometimes downloading a whole bucket in one session, and Wiz says the theft appears opportunistic.
Wiz also found a bootable Linux image on the attacker’s main server that, once started, takes shell commands from that server for 90 minutes and then reboots. Wiz hasn’t seen it used. From Oct 8 to Oct 11, a separate actor used customer-owned AWS keys that Wiz believes were made for Qubole integrations. That actor compromised a small number of environments, but Wiz can’t link it to the role assumptions.
Wiz doesn’t say how the attacker got the credentials from Qubole’s account, and it declined to tell The Register how many organizations were hit. Neither Qubole nor AWS responded to The Register.
- Vendor
- Qubole
What to do
8 steps
Indicators
IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| IP address | OVH server, the attacker’s main address for role assumption and harvesting | |
| IP address | OVH address used to test stolen credentials | |
| IP address | Mullvad VPN exit used for role assumption, not conclusive alone | |
| IP address | Mullvad VPN exit used for role assumption, not conclusive alone | |
| IP address | Mullvad VPN exit used for role assumption, not conclusive alone | |
| File name | Bootable Linux image hosted on the attacker’s main server | |
| SHA-256 | sso_agent.iso | |
| SHA-1 | sso_agent.iso | |
| MD5 | sso_agent.iso |
- IP addressOVH server, the attacker’s main address for role assumption and harvesting
- IP addressOVH address used to test stolen credentials
- IP addressMullvad VPN exit used for role assumption, not conclusive alone
- IP addressMullvad VPN exit used for role assumption, not conclusive alone
- IP addressMullvad VPN exit used for role assumption, not conclusive alone
- File nameBootable Linux image hosted on the attacker’s main server
- SHA-256sso_agent.iso
- SHA-1sso_agent.iso
- MD5sso_agent.iso
Timeline
- Oct 8–11A separate actor tests customer-owned AWS keys that Wiz believes were made for Qubole integrations.
- Oct 14–26The attacker assumes customer integration roles from Qubole’s AWS account, starting from a VPN address, Wiz says.
- Oct 18The attacker starts using a second IAM user from Qubole’s account.
- Nov 9Wiz publishes its findings, with indicators and CloudTrail queries.
Sources
- Wiz researchPrimary source wiz.io
- The Register news reportReporting theregister.com