[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1BbTVEbq6GD2AQPuAKscxqIJzBWQPdamjnPcKVeqsyQ":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"ae81e20c-02cc-45ae-8865-d13f36711d53","Over a Dozen Organizations Hit in Qubole Supply Chain Attack","over-a-dozen-organizations-hit-in-qubole-supply-chain-attack-40742b","Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials. The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek.","A threat actor exploited compromised IAM credentials for a Qubole AWS account to steal data from over a dozen organizations. The attackers assumed IAM roles that organizations had set up for Qubole's AWS account, accessing their AWS environments. These roles were often left in place long after Qubole was no longer in use, allowing the threat actor to enumerate resources, collect secrets, and access data from October 14 to October 26.","Attackers exploited compromised Qubole IAM credentials to steal data from over a dozen organizations.","https:\u002F\u002Fwww.securityweek.com\u002Fover-a-dozen-organizations-hit-in-qubole-supply-chain-attack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fsupply-chain-attack.jpeg","2026-11-10T13:27:44+00:00","2026-11-10T14:00:22.121953+00:00",8,[17,20,23],{"name":18,"type":19},"Qubole","product",{"name":21,"type":22},"AWS","technology",{"name":24,"type":22},"IAM","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":25,"icon":27,"name":28,"slug":29},null,"Supply Chain","supply-chain",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":51,"vendors":135},[52,80,109],{"slug":53,"name":54,"problem":55,"products":56},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[57,64,72],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":53,"product_name":61,"url":62,"description":63},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":81,"name":82,"problem":83,"products":84},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"slug":110,"name":111,"problem":112,"products":113},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":123,"product_name":124,"url":125,"description":126},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",[136],{"slug":115,"name":116,"logo_path":117,"roles":137},[138],"reported_by",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"stale-third-party-iam-roles-enable-qubole-supply-chain-data-theft","Stale Third-Party IAM Roles Enable Qubole Supply Chain Data Theft","Attackers exploited compromised Qubole AWS IAM credentials to assume cross-account roles that victim organizations had configured for Qubole's use, gaining unauthorized access to their AWS environments. The core failure was that organizations never revoked or audited these IAM roles after discontinuing their use of Qubole, leaving persistent, privileged access pathways open for years. This is a textbook supply chain access control failure: trusting a third-party vendor with standing cloud permissions without enforcing a lifecycle process to remove that trust when the relationship ends. The incident highlights how third-party integrations create implicit, long-lived attack surfaces that are frequently forgotten. Attackers had a 12-day window to enumerate resources, harvest secrets, and exfiltrate data entirely because no one was watching these dormant roles.",[144,145,146,147,148],"CIS Control 5: Account Management (v8)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 AC-2: Account Management","NIS2 Article 21(2)(d)","NIST CSF 2.0 PR.AA-05: Access Permissions and Authorizations",{"NIS2 Article 21(2)(d)":150,"CIS Control 5: Account Management (v8)":151,"NIST SP 800-53 AC-2: Account Management":152,"CIS Control 6: Access Control Management (v8)":153,"NIST CSF 2.0 PR.AA-05: Access Permissions and Authorizations":154},"NIS2 Article 21(2)(d) explicitly requires security measures addressing supply chain risks, including the security of relationships with direct suppliers, which would have mandated controls over third-party cloud access and their revocation upon offboarding.","CIS Control 5 requires organizations to manage the lifecycle of all accounts, including disabling or removing credentials and access rights for third parties no longer in use, which would have prevented the stale Qubole IAM roles from remaining exploitable.","AC-2 requires organizations to review accounts for compliance with account management requirements and remove or disable accounts that are no longer needed, directly applicable to the unrevoked third-party IAM roles here.","CIS Control 6 calls for granting access based on least privilege and regularly reviewing access rights, which would have identified and removed the excessive, dormant cross-account IAM roles granted to Qubole.","This category requires that access permissions are managed, enforced, and reviewed, including removal of access that is no longer required, which would have caught the abandoned Qubole cross-account roles before attackers could exploit them."]