# Attackers Hijack Qubole's AWS Trust

> Attackers used Qubole's AWS credentials to steal secrets from customer cloud accounts.
- Title: Attackers Hijack Qubole's AWS Trust · BigGo Finance | Shortify
- Summary: Attackers used Qubole's AWS credentials to steal secrets from customer cloud accounts.
- Keywords: qubole, aws, cloud security, trufflehog, secrets manager, ssm parameter store, lambda, s3 buckets, iam roles, cloudtrail, markets, BigGo Finance
- Source: BigGo Finance — https://finance.biggo.com/news/6c27bba9-ae1e-4d40-a2eb-8515c7f01c06
- Author: BigGo Finance
- Published: 2026-11-09T20:25:17+00:00
- Read time: 1 min
- Topics: qubole, aws, cloud security, trufflehog, secrets manager, ssm parameter store, lambda, s3 buckets, iam roles, cloudtrail, finance, markets
## Attackers exploit Qubole's AWS trust
Attackers used credentials tied to Qubole's AWS account to assume customer integration roles between Oct 14 and Oct 26.

> Attackers used credentials tied to Qubole's AWS account to assume customer integration roles and steal secrets and data from multiple cloud environments between Oct. 14 and Oct. 26
## Key attack methods
The intruders pulled Lambda environment variables, Secrets Manager entries and SSM parameters, tested them with TruffleHog, and copied data from S3 buckets.

> The intruders pulled Lambda environment variables, Secrets Manager entries and SSM parameters, tested them with TruffleHog, and copied data from S3 buckets
## How trust was exploited
Dormant roles that still trusted Qubole's account let the requests through.

> Dormant roles that still trusted Qubole's account let the requests through
## Separate attack episode
A separate Oct 8-11 episode involved customer-owned access keys.

> A separate Oct. 8-11 episode involved customer-owned access keys
## Attack credentials
Attackers used IAM user AIDA3W7DIFLYOLTK63SFS starting Oct 14 and a second user AIDAJYRRH5Y3A7AAJM2HW from Oct 18.

> Requests came through IAM user AIDA3W7DIFLYOLTK63SFS beginning Oct. 14, and from Oct. 18 a second IAM user in the same account, AIDAJYRRH5Y3A7AAJM2HW, was also used
## Data stolen
The attacker copied victims' AWS access keys, Microsoft Entra ID client secrets and Okta client credentials.

> The loot included victims' own AWS access keys, Microsoft Entra ID client secrets and Okta client credentials
## Wiz's analysis
Wiz described the main campaign as a 'broad, opportunistic supply chain campaign' with no known group behind it.

> Wiz, part of Google, described the main campaign as a "broad, opportunistic supply chain campaign" and declined to say how many organizations were affected
## Defenders should check
Organizations should review CloudTrail logs from Oct 1 onward for AssumeRole requests from Qubole's account.

> Any organization that has connected Qubole to AWS, including those that no longer use it, should examine CloudTrail logs from Oct. 1 onward
## Key takeaway

Attackers exploited Qubole's AWS trust relationship to access customer cloud environments and steal secrets between Oct 14 and Oct 26.