Most cloud trust decisions are made once and never revisited. A supply chain intrusion disclosed this week is what that habit costs.
A three-way investigation by Wiz, Sentra and Google’s Mandiant tracked an intruder who borrowed IAM credentials from Qubole’s own AWS account, then assumed roles inside customer environments from October 14 to October 26.
Roles that outlived the contract
Qubole is a cloud data processing platform that reaches into customer accounts through cross-account IAM roles, so customers never hand over long-lived access keys. Many organizations left those role trust policies in place after dropping the platform. The attacker assumed them anyway.
Not one of the malicious role-assumption requests Wiz logged was rejected; each one presented the correct External ID and went through. Traffic originated from Qubole AWS account 805246085872 using IAM user AIDA3W7DIFLYOLTK63SFS, with most later activity routed through an OVH-hosted VPS. A second identity from the same account appeared on October 18.
What walked out of the accounts
Once inside, the intruder enumerated S3 buckets, databases, EC2 instances and IAM identities, then pulled credentials from Secrets Manager, Systems Manager Parameter Store and Lambda configuration. Data left S3, in some cases entire buckets in single sessions.
Everything gathered was run through TruffleHog, and the harvest included Okta OAuth client credentials, Microsoft Entra ID service principal secrets and plain AWS access keys. Sentra recorded over 100 passwords and keys readable within minutes, plus thousands more inside downloaded files. Wiz saw no write operations, pointing to theft rather than disruption.
Rotating a credential will not kill a session already issued. Review CloudTrail from October 1 for AssumeRole calls from account 805246085872 and revoke those sessions.
