Qubole Platform Exploited to Access Customer AWS Accounts, Steal Data
Attackers compromised multiple Qubole customer AWS accounts between October 14-26, exploiting the data lake platform's trusted access to steal sensitive data and secrets.
An attacker successfully breached the AWS accounts of several Qubole customers between October 14 and October 26, exfiltrating stored data and secrets. The intrusion was facilitated by exploiting the credentials that Qubole's platform uses to access its customers' cloud environments. The precise method by which the attacker acquired these credentials remains undisclosed.
Qubole, a data lake platform now owned by Idera, operates within the AWS accounts of its clients. To grant Qubole access, customers typically create an IAM role with specific permissions. The trust policy of this role allows Qubole's AWS account to assume it, thereby granting the necessary permissions. Each such assumption request, known as AssumeRole, requires a corresponding External ID provided by Qubole.
According to cloud security firm Wiz, which identified the activity, most of the compromised roles were not actively in use. However, because these roles still trusted Qubole's account, the attacker's unauthorized AssumeRole requests were successful. Organizations that have integrated Qubole with their AWS environments, even if they are no longer actively using the service, are advised to scrutinize their CloudTrail logs from October 1 onwards.
The tell-tale sign to look for is an AssumeRole request originating from Qubole's platform AWS account (ID 805246085872) but coming from an IP address outside of AWS's known ranges. Wiz researchers noted that Qubole's legitimate traffic consistently originates from AWS IP addresses.
During the compromise, the attacker actively searched for and exfiltrated credentials. This included reading environment variables from Lambda functions, extracting secrets from AWS Secrets Manager, and accessing data from the SSM Parameter Store. The stolen credentials, such as AWS access keys, Entra ID client secrets, and Okta client credentials, were then tested using tools like TruffleHog. Additionally, the attacker downloaded data directly from S3 buckets accessible via the compromised roles, sometimes copying entire buckets in a single session.
While this specific campaign has not been linked to other known threat actor activities, a separate incident involving Qubole was also observed between October 8 and October 11. In this earlier event, an attacker utilized customers' AWS access keys, believed to have been configured for Qubole, to compromise cloud environments. This activity is distinct from the AssumeRole abuse detailed above.
Wiz has provided detailed hunting guidance for affected organizations. This includes monitoring CloudTrail logs for suspicious AssumeRole requests, specific IAM principal IDs, and traffic originating from known attacker IP addresses or VPNs. They also recommend investigating any activity associated with specific IAM user IDs and session names that deviate from normal patterns.
To mitigate the risk, organizations are advised to rotate all secrets and credentials accessible by the compromised roles, revoke active sessions, and remove unnecessary Qubole roles. Implementing stricter trust policies, such as limiting AssumeRole requests to vendor-specific network ranges using aws:SourceIp conditions, is also recommended. The External ID should not be relied upon as the sole security control, as it is logged in plain text.