[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc4BlqXRR9BPH_1bcT02QvqWQYVFTTBso4FotE4k7C8c":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"d5a6eb97-42a6-42b2-9271-bfb9c981b104","Hackers exploit trusted AWS access to breach multiple cloud environments","hackers-exploit-trusted-aws-access-to-breach-multiple-cloud-environments-ddf41e","A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments. [...]","A threat actor compromised Qubole's AWS IAM users and assumed roles in multiple customer AWS accounts to access and exfiltrate data. The campaign, which ran from October 14-26, affected dozens of companies, with millions of files stolen from one customer. The attacker used tools like TruffleHog to find secrets and downloaded data from accessible S3 buckets.","Hackers exploited Qubole's AWS IAM credentials to breach multiple cloud environments.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-trusted-aws-access-to-breach-multiple-cloud-environments\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F08\u002F21\u002Fawskey.jpg","2026-11-10T19:31:11+00:00","2026-11-10T20:00:19.6542+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Qubole","vendor",{"name":21,"type":22},"AWS","technology",{"name":24,"type":19},"Wiz",{"name":26,"type":19},"Sentra",{"name":28,"type":19},"Mandiant",{"name":30,"type":22},"Microsoft Entra ID","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":31,"icon":33,"name":34,"slug":35},null,"Supply Chain","supply-chain",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"malware","TruffleHog","Tool used by the attacker to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.",[18,24,26],{"controls":61,"vendors":142},[62,90,119],{"slug":63,"name":64,"problem":65,"products":66},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":63,"product_name":87,"url":88,"description":89},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":91,"name":92,"problem":93,"products":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":120,"name":121,"problem":122,"products":123},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[124,129,134],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":125,"product_name":126,"url":127,"description":128},"falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":130,"product_name":131,"url":132,"description":133},"cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",[143,149],{"slug":144,"name":145,"logo_path":146,"roles":147},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[148],"reported_by",{"slug":150,"name":24,"logo_path":151,"roles":152},"wiz","\u002Fvendor-logos\u002Fwiz.png",[148],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":163},"compromised-third-party-aws-credentials-enable-multi-tenant-cloud-breach","Compromised Third-Party AWS Credentials Enable Multi-Tenant Cloud Breach","Attackers compromised IAM users within Qubole, a cloud data platform, and leveraged trusted role-assumption relationships to pivot into dozens of customer AWS accounts — a classic supply chain trust abuse. The root failure was the existence of overly permissive cross-account IAM roles that allowed a compromised vendor identity to reach customer environments without additional verification. Tools like TruffleHog were used to harvest embedded secrets from accessible resources, amplifying the damage once initial access was gained. This incident illustrates how third-party cloud integrations can silently expand your attack surface, turning a vendor's breach into your own data exfiltration event.",[158,159,160,161,162],"NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIS2 Article 21(2)(d)","MITRE ATT&CK T1199: Trusted Relationship",{"NIS2 Article 21(2)(d)":164,"NIST SP 800-53 AC-6: Least Privilege":165,"NIST SP 800-53 AC-2: Account Management":166,"MITRE ATT&CK T1199: Trusted Relationship":167,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":168},"NIS2's supply chain security point requires entities to assess and manage the security risks introduced by third-party service providers, directly applicable to trusting a vendor's IAM identity with cross-account access.","AC-6 mandates that accounts and roles operate with the minimum permissions necessary, limiting how much of a customer environment an attacker could access after assuming a compromised vendor role.","AC-2 requires organizations to manage and monitor accounts granted to external parties, which would have prompted regular review and tightening of the cross-account IAM roles Qubole customers had provisioned.","This technique describes adversaries exploiting trusted third-party connections to gain access to target environments, which is precisely how the attacker used Qubole's compromised IAM identity to pivot into customer accounts.","This control requires organizations to define and monitor security requirements for supplier access, which would have included controls over what cross-account AWS permissions Qubole was granted."]