Attackers backdoor trusted AWS integrations to steal secrets
Attackers abuse compromised Qubole AWS credentials to steal secrets from customer environments via supply-chain attack.
Unknown attackers compromised IAM credentials associated with Qubole's AWS account and exploited cross-account trust relationships to access multiple customer AWS environments, stealing secrets from S3 buckets, Lambda, Secrets Manager, and SSM Parameter Store. Wiz researchers, working with Google Mandiant, traced the malicious activity back to October 14, revealing the threat actors used TruffleHog to test credentials and harvest OAuth tokens from Okta and Microsoft Entra ID. The campaign affected multiple organizations that had integrated with Qubole and failed to revoke deprecated trust policies.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers compromised IAM credentials belonging to Qubole, a trusted AWS integration partner, and leveraged cross-account trust relationships to pivot into multiple customer AWS environments. The root failure was twofold: Qubole's credentials were inadequately protected, and customer organizations never revoked deprecated trust policies after they were no longer needed. This matters because third-party integrations extend your attack surface beyond your own perimeter — an adversary who owns a trusted partner effectively owns a door into your environment. The theft of secrets from S3, Lambda, Secrets Manager, and SSM Parameter Store demonstrates how over-privileged, stale cross-account roles amplify the blast radius of a single supplier compromise.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — TruffleHog