Hackers exploit trusted AWS access to breach multiple cloud environments

A threat actor breached multiple corporate cloud environments between October 14 and October 26, 2026, by exploiting compromised Amazon Web Services credentials belonging to big data platform Qubole. According to BleepingComputer's report, the attacker leveraged cross-account trust relationships to enter customer infrastructure and exfiltrate sensitive files. The intrusion affected organizations that maintained external Identity and Access Management permissions configured to trust Qubole's cloud account.

This breakdown details the mechanics of the cross-account intrusion, the tools deployed during reconnaissance, and the scope of data stolen across customer environments. It is written for cloud security engineers, infrastructure architects, and compliance leads who oversee enterprise cloud trusts. The analysis covers the specific credential theft techniques, the rapid validation of external tokens, and mandatory mitigation steps required to secure affected environments.

01Compromised identity credentials and cross-account roles

Enterprise analytics platforms like Qubole integrate directly with customer environments to process large datasets and manage machine learning workloads. Customers enable this operational integration by establishing dedicated cross-account Identity and Access Management roles within their own cloud tenants. These trust policies specify which external accounts can request access, while role permissions dictate allowable computing and administrative actions.

External service providers typically invoke the AWS Security Token Service AssumeRole application programming interface to generate temporary administrative credentials. This standard connection model grants the third-party platform authorized operational control to run scheduled processing jobs. When an upstream provider suffers an identity compromise, those legitimate trust relationships can become direct pathways into connected client infrastructure.

In this multi-tenant intrusion, the threat actor secured unauthorized entry by compromising two distinct Qubole identity users. The attacker then used those credentials to invoke cross-account access against downstream organizations that had established trust configurations. Because the policies remained active in client accounts, the attacker inherited full authorization defined within each trusted role.

02Joint investigation and dormant role assumption

The unauthorized intrusion came to light after data security and governance firm Sentra detected suspicious behavioral patterns across its customer base. Sentra shared its initial intelligence with cloud security provider Wiz to track the attack path across multiple cloud environments. Cybersecurity firm Mandiant subsequently joined the collaborative investigation to trace the attacker across affected customer accounts.

Investigators discovered that the attacker specifically targeted customer accounts containing historical trust configurations that were no longer in active use. Many downstream organizations had retained old Qubole roles without cycling permissions or removing the external trust links. The attacker identified these dormant roles and assumed them without triggering standard operational alarms or user collision errors.

Once the attacker assumed an unused role, the session operated entirely within legitimate permissions previously granted to Qubole. Security teams observing the environment initially saw valid role assumptions originating from the vendor's designated cloud account. This administrative masquerade allowed the threat actor to conduct deep internal reconnaissance without immediately exposing their unauthorized presence.

03Secret harvesting and TruffleHog credential validation

After securing cross-account access, the threat actor initiated automated reconnaissance across compromised client environments. The attacker surveyed available infrastructure, pulled sensitive configuration parameters from SSM Parameter Store, and extracted production credentials stored in AWS Secrets Manager. In addition, the intruder scraped environment variables attached to serverless Lambda functions to locate exposed keys.

The exfiltration of stored secrets occurred at an unusually rapid operational pace. Investigators from Sentra noted that the attacker collected credentials at a speed of 100 passwords and cryptographic keys within a seven-minute window. This rapid harvesting indicates the attacker deployed scripted tooling to interrogate secret storage repositories the moment an assumed role opened access.

To filter and verify the harvested credentials, the attacker deployed the open-source TruffleHog scanner directly against discovered assets. The tool automatically verified live AWS access keys, Microsoft Entra ID client secrets, and Okta client credentials. This verification step allowed the threat actor to identify valid authentication tokens that could enable broader lateral movement across corporate systems.

04Systematic bucket enumeration and data exfiltration

Following initial credential discovery, the attacker moved to extract mass data from cloud storage repositories. The intrusion followed an opportunistic approach across all reachable storage assets rather than targeting specific preselected data files. Researchers at Wiz tracked a uniform sequence of API commands executed across every compromised tenant during the campaign.

The standardized extraction cycle began with ListBuckets calls to map every accessible S3 storage container within the customer account. The attacker then executed ListObjects and HeadObject commands to enumerate folder contents, inspect metadata properties, and identify stored files. Finally, the attacker issued repeated GetObject requests to systematically transfer stored objects out of the environment.

The volume of stolen enterprise data was substantial across the victim base. Sentra confirmed that dozens of organizations suffered successful intrusions, with millions of files exfiltrated from a single compromised customer alone. The attacker downloaded everything reachable under the assumed role permissions, compounding the operational and regulatory impact for affected enterprises.

05CloudTrail log audits and session revocation

Security administrators managing AWS environments must audit AWS CloudTrail logs from October 1 onward to identify unauthorized activity. Engineering teams should search specifically for role assumption events originating from Qubole's cloud account and inspect subsequent API calls. Particular attention must be given to unauthorized ListBuckets, GetObject, and Secrets Manager requests executed during that timeframe.

Administrators who identify suspicious cross-account activity must immediately terminate all active IAM role sessions to expel active intruders. Any secrets, database passwords, or third-party API tokens stored in compromised Secrets Manager, Parameter Store, or Lambda configurations require emergency rotation. External identity providers, including Microsoft Entra ID and Okta, should be reviewed for compromised client credentials.

The investigation report did not disclose the initial access vector used to compromise Qubole, nor has Qubole issued a public announcement. Organizations must eliminate unused vendor integrations and restrict remaining roles through explicit policy conditions and permitted source networks. Establishing strict external identification checks and conducting recurring trust policy audits ensures dormant provider connections cannot be abused.