{
  "id": 19215989,
  "title": "Attackers backdoor trusted AWS integrations to steal secrets",
  "url": "https://urgent.news/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets",
  "topic": "science",
  "section": "Science",
  "published": "2026-11-09T19:59:50.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553"
  },
  "original_language": "en",
  "account": "Attackers exploited compromised IAM credentials from Qubole's AWS account to infiltrate customer AWS environments and extract sensitive data. Qubole is a cloud data processing platform that utilizes cross-account IAM roles to manage compute and storage in customers' AWS environments without requiring long-lived AWS access keys. This supply-chain attack leveraged the trust relationship between Qubole and customers' AWS accounts. Google's cloud-security team Wiz did not disclose the number of affected organizations, referring to it as a \"broad, opportunistic supply chain campaign\" targeting multiple customer environments. The researchers explained that due to many organizations leaving trust policies active even after deprecation, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and exfiltrate data.\n\nWiz, in collaboration with Google's Mandiant incident responders, discovered the malicious activity dating back to October 14. The attackers utilized IAM user ID AIDA3W7DIFLYOLTK63SFS associated with Qubole's AWS account (805246085872) to initiate AWS API calls, including the sts:AssumeRole API, to acquire temporary credentials for customer-managed integration roles. The researchers noted that this activity continued until October 18, with the intrusion team observing the same IAM user in the affected environments.\n\nDuring their investigation, the threat hunters observed the attackers probing various AWS services, stealing credentials, keys, and secrets stored across Lambda, Secrets Manager, and SSM Parameter Store. They also utilized TruffleHog to discover victim organization's Microsoft Entra ID secrets and request OAuth tokens using Okta client credentials. The attackers demonstrated an opportunistic approach by stealing data from customers' S3 storage, often downloading entire buckets rather than specifically targeting valuable data.\n\nWiz has not attributed the supply chain attack to a specific threat group and does not possess information on how the stolen data is being utilized. While investigating the incident, Wiz identified a separate campaign between October 8 and October 11, which also exploited customer-owned AWS access keys for Qubole integrations. Although it is unclear if these incidents are connected, organizations that have integrated with Qubole are advised to rotate credentials, review CloudTrail logs from October 1 onward for suspicious AssumeRole events involving Qubole's AWS account ID, and revoke active sessions for any assumed roles.",
  "summary": "Wiz researchers uncovered the secret-stealing supply-chain attack",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}