Researchers say attackers abused Qubole-related AWS credentials and dormant customer roles to steal cloud data, prompting urgent reviews of access, secrets and active sessions.
Attackers used compromised credentials associated with big-data platform Qubole to enter the Amazon Web Services environments of more than a dozen organizations and steal data, according to research from Wiz, Sentra and Mandiant. The campaign shows how access granted to a vendor can remain a risk after customers stop using its service.
The attackers used Qubole-related AWS credentials to assume roles that customers had created for the platform. Cross-account roles are a standard way for cloud services to access customer environments. Customers typically grant a vendor’s AWS account permission to assume a role, using an External ID as an additional check. Researchers said every attributed request included the valid External ID and succeeded.
Wiz and Sentra observed the main campaign from October 14 to October 26. The attackers enumerated cloud resources, collected secrets and configurations, and accessed data. Wiz identified role sessions beginning “quiam-,” including “quiam-enum” and “quiam-scope-full.” In many observed environments, the attacker was the only entity assuming the vendor role during October.
Some roles had been left in place after customers stopped using Qubole. Sentra said certain roles could read nearly all the data the attackers sought. A dormant integration can therefore remain a route into a cloud account when the credentials it trusts are compromised.
The attackers searched AWS storage locations for secrets, tested credentials with TruffleHog, then took data from customer S3 buckets. Wiz said the activity appeared opportunistic: attackers read what each role could reach, sometimes downloading entire buckets. Stolen material included AWS keys, Microsoft Entra ID service-principal secrets, Okta OAuth credentials, source-control and CI credentials, database and identity-provider secrets, monitoring keys and vendor tokens, Sentra reported.
Researchers also identified a separate Qubole-related campaign active October 8–11. Attackers tested customer-owned AWS access keys created for Qubole integrations and, in a small number of cases, used them to compromise cloud environments. This was distinct from the later abuse of Qubole’s credentials and customer roles.
The activity came through rented OVH infrastructure and Mullvad VPN connections, not Qubole’s network, Sentra said. Wiz found an attacker-hosted bootable Linux image, `sso_agent.iso`, on the OVH infrastructure. It gathered system information, communicated over TCP port 23458 and could execute remotely supplied shell commands. Wiz found no evidence it was deployed against victims and could not confirm it was used in the attacks.
Small IT teams should check whether Qubole integrations and AWS roles remain necessary. Wiz recommends reviewing CloudTrail from October 1 for `AssumeRole` activity involving Qubole-related roles, including sessions with the “quiam-” naming pattern. Remove obsolete roles. For integrations still in use, restrict permissions to the resources and actions they require.
Rotate every secret, parameter and Lambda environment variable accessible to the assumed roles, and revoke active sessions. Credential rotation alone does not end temporary sessions that have already been issued. Teams should also review S3 access for unusual reads and investigate whether exposed credentials were used elsewhere. Since stolen material included credentials for other services, rotation may need to cover source control, CI, identity providers and databases as well as AWS.
The activity has not been attributed to a known threat group. Wiz said it found no links to other publicly reported campaigns and could not determine the attacker’s motive or intended use of the stolen data. Researchers’ findings point to an immediate priority for affected organizations: close unneeded access and establish which data and credentials were exposed.
Ryan Mitchell serves as a Staff Writer for Just Right News, where he anchors the desk for Cyber, Technology Policy, and Digital Sovereignty. In an era where the digital landscape has become as much a battlefield as any physical territory, Ryan provides a critical conservative lens on the forces shaping the future of American innovation and national security. His work is defined by a commitment to the idea that American leadership in the digital age is not just a matter of economic success, but a necessity for the preservation of global liberty.
Born and raised in Austin, Texas, Ryan’s perspective is deeply rooted in the Lone Star State’s tradition of independence and skepticism of centralized authority. Growing up in a city that transformed from a quiet state capital into a global technology hub, he witnessed firsthand the disruptive power of the tech industry. This upbringing instilled in him a firm belief in free-market principles and the necessity of protecting individual liberties from both government overreach and corporate overstep. His Texan background serves as a foundational compass, guiding his reporting toward stories that emphasize national resilience and the preservation of constitutional values in an increasingly virtual world.
Now based in San Francisco, California, Ryan operates from the epicenter of the very industry he scrutinizes. Living and working in the heart of Silicon Valley allows him to provide “boots on the ground” reporting that few conservative journalists can match. He navigates the cultural and political complexities of the Bay Area to bring Just Right News readers an inside look at the boardrooms and coding labs where the next generation of digital policy is forged. For Ryan, being stationed in San Francisco is a strategic choice; it allows him to challenge the prevailing ideological monoculture of the tech elite from within their own backyard, ensuring that the concerns of middle America are represented in the conversation about our digital future.
His beat—Cyber, Technology Policy, and Digital Sovereignty—covers the high-stakes world of data privacy, artificial intelligence, and the infrastructure of the modern web. Ryan is particularly focused on the concept of digital sovereignty, arguing that for a nation to remain truly free, it must maintain control over its own technological destiny and critical infrastructure. He frequently explores how international regulations and domestic policies impact the ability of American firms to compete without sacrificing the privacy or security of their citizens.
Central to his current body of work is his featured series, “The New Cold War.” Through this project, Ryan examines the escalating technological rivalry between the United States and its global adversaries. He delves into the complexities of state-sponsored hacking, the global race for semiconductor dominance, and the ideological struggle to define the rules of the internet. Ryan views this competition not merely as a commercial race, but as a fundamental defense of Western values against authoritarian digital models. Through his rigorous reporting and principled analysis, Ryan Mitchell ensures that the readers of Just Right News stay informed about the invisible forces defining the 21st century, always advocating for a future where technology serves the cause of freedom.