Hackers exploit trusted AWS access to breach multiple cloud environments
A credential leak at trusted AWS is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
A credential leak at trusted AWS is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.
The campaign ran between October 14 and 26, and affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated with Qubole.
Wiz started to investigate the attack after data security and governance company Sentra shared information about suspicious activity observed in some of its customers' environments.
The researchers found that the attacker had compromised two Qubole IAM users and assumed otherwise unused roles in multiple customers’ AWS accounts that had previously been configured to trust Qubole’s account, granting them access within the role’s permissions.
They then used the TruffleHog tool to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.
Anyone connected to trusted AWS through the compromised trust relationship is potentially affected, not just trusted AWS itself.
Qubole is an enterprise cloud data processing and analytics platform that helps companies manage large datasets and run machine learning workloads.
Companies can grant third-party providers such as Qubole access to their AWS resources by creating cross-account IAM roles.
There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.
It also offers AWS integration to allow computing resource management.
Trust policies determine which external AWS accounts can take these roles, and permissions are set to define the resources and actions allowed.
The trust mechanism involved here is a misconfigured IAM role, which is what let access move between otherwise unrelated systems.
Researchers at cloud security company Wiz explain that external providers use AWS’s STS AssumeRole API to obtain temporary credentials for accessing customers' resources in the cloud.
However, Sentra confirmed dozens of victims and millions of files stolen from one customer alone.
trusted AWS says the credential has been revoked, and no exploitation has been confirmed so far.
Potentially impacted administrators are advised to review CloudTrail from October 1 onward for suspicious access from Qubole’s AWS account, investigate subsequent secret and S3 access, rotate exposed credentials, and revoke active role sessions.
It is also recommended to remove unused integrations and restrict remaining roles’ permissions, trusted identities, and permitted source networks.
If you have any integration or dependency involving trusted AWS, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
Update 11/11 - An AWS spokesperson sent BleepingComputer the below comment: AWS services were not compromised by this issue and operated as designed.
What happened
A credential leak at trusted AWS is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.
The campaign ran between October 14 and 26, and affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated with Qubole.
What changed
Wiz started to investigate the attack after data security and governance company Sentra shared information about suspicious activity observed in some of its customers' environments.
The researchers found that the attacker had compromised two Qubole IAM users and assumed otherwise unused roles in multiple customers’ AWS accounts that had previously been configured to trust Qubole’s account, granting them access within the role’s permissions.
They then used the TruffleHog tool to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.
Who is affected
Anyone connected to trusted AWS through the compromised trust relationship is potentially affected, not just trusted AWS itself.
Qubole is an enterprise cloud data processing and analytics platform that helps companies manage large datasets and run machine learning workloads.
Companies can grant third-party providers such as Qubole access to their AWS resources by creating cross-account IAM roles.
Why it matters
There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.
It also offers AWS integration to allow computing resource management.
Trust policies determine which external AWS accounts can take these roles, and permissions are set to define the resources and actions allowed.
Technical details
The trust mechanism involved here is a misconfigured IAM role, which is what let access move between otherwise unrelated systems.
Researchers at cloud security company Wiz explain that external providers use AWS’s STS AssumeRole API to obtain temporary credentials for accessing customers' resources in the cloud.
However, Sentra confirmed dozens of victims and millions of files stolen from one customer alone.
Response
trusted AWS says the credential has been revoked, and no exploitation has been confirmed so far.
Potentially impacted administrators are advised to review CloudTrail from October 1 onward for suspicious access from Qubole’s AWS account, investigate subsequent secret and S3 access, rotate exposed credentials, and revoke active role sessions.
It is also recommended to remove unused integrations and restrict remaining roles’ permissions, trusted identities, and permitted source networks.
What security teams should do
If you have any integration or dependency involving trusted AWS, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Update 11/11 - An AWS spokesperson sent BleepingComputer the below comment: AWS services were not compromised by this issue and operated as designed.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.