From BigGo Finance · BigGo Finance · · 1m 10s
Attackers Hijack Qubole's AWS Trust
Attackers used Qubole's AWS credentials to steal secrets from customer cloud accounts.
In brief
Attackers used Qubole's AWS credentials to steal secrets from customer cloud accounts. Attackers exploited Qubole's AWS trust relationship to access customer cloud environments and steal secrets between Oct 14 and Oct 26. Originally reported by BigGo Finance.
Attackers exploit Qubole's AWS trust
Attackers used credentials tied to Qubole's AWS account to assume customer integration roles between Oct 14 and Oct 26.
“Attackers used credentials tied to Qubole's AWS account to assume customer integration roles and steal secrets and data from multiple cloud environments between Oct. 14 and Oct. 26”
Key attack methods
The intruders pulled Lambda environment variables, Secrets Manager entries and SSM parameters, tested them with TruffleHog, and copied data from S3 buckets.
“The intruders pulled Lambda environment variables, Secrets Manager entries and SSM parameters, tested them with TruffleHog, and copied data from S3 buckets”
How trust was exploited
Dormant roles that still trusted Qubole's account let the requests through.
“Dormant roles that still trusted Qubole's account let the requests through”
Separate attack episode
A separate Oct 8-11 episode involved customer-owned access keys.
“A separate Oct. 8-11 episode involved customer-owned access keys”
Attack credentials
Attackers used IAM user AIDA3W7DIFLYOLTK63SFS starting Oct 14 and a second user AIDAJYRRH5Y3A7AAJM2HW from Oct 18.
“Requests came through IAM user AIDA3W7DIFLYOLTK63SFS beginning Oct. 14, and from Oct. 18 a second IAM user in the same account, AIDAJYRRH5Y3A7AAJM2HW, was also used”
Data stolen
The attacker copied victims' AWS access keys, Microsoft Entra ID client secrets and Okta client credentials.
“The loot included victims' own AWS access keys, Microsoft Entra ID client secrets and Okta client credentials”
Wiz's analysis
Wiz described the main campaign as a 'broad, opportunistic supply chain campaign' with no known group behind it.
“Wiz, part of Google, described the main campaign as a "broad, opportunistic supply chain campaign" and declined to say how many organizations were affected”
Defenders should check
Organizations should review CloudTrail logs from Oct 1 onward for AssumeRole requests from Qubole's account.
“Any organization that has connected Qubole to AWS, including those that no longer use it, should examine CloudTrail logs from Oct. 1 onward”
The big picture
Attackers exploited Qubole's AWS trust relationship to access customer cloud environments and steal secrets between Oct 14 and Oct 26.
