Attackers backdoor trusted AWS integrations to steal secrets

Attackers compromised Qubole's AWS account credentials to gain access to customer environments, stealing sensitive data from S3 buckets. Qubole, a cloud data processing platform, utilizes cross-account IAM roles to manage access to customers' AWS resources without requiring customers to provide long-lived AWS access keys. The supply-chain attack exploited this trust relationship.

Google's cloud-security firm, Wiz, declined to disclose the number of affected organizations but described it as a "broad, opportunistic supply chain campaign" targeting "multiple" customer environments. Wiz, collaborating with Google's Mandiant incident responders after AI data security firm Sentra detected suspicious activity, traced the malicious actions back to October 14, when the attackers used Qubole's AWS account credentials to assume integration roles, enumerate cloud resources, harvest secrets, and exfiltrate data.

The attackers conducted activities across affected environments, with no evidence of the IAM user engaging in any other activity. They continued their attacks on October 15 and 18, probing AWS services and stealing credentials, keys, and secrets from Lambda, Secrets Manager, and SSM Parameter Store. The criminals also employed TruffleHog to discover Microsoft Entra ID secrets and request OAuth tokens using Okta client credentials, as well as to steal data from customers' S3 storage.

The attackers appeared to be opportunistic, downloading entire buckets rather than pursuing specific data. The threat actors have not been identified, and the misuse of stolen data remains unknown. Wiz discovered another campaign between October 8 and 11, using customer-owned AWS access keys for Qubole integrations. While a small number of these cases involved compromising AWS environments, the researchers could not definitively link the two sets of malicious activity.

Organizations relying on Qubole integrations should rotate credentials, review CloudTrail logs for AssumeRole events associated with Qubole's AWS account ID (805246085872), and revoke active sessions for the threat actor's integration roles.