[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9VvkRbWogl2pwGZhdJb4OcW2i15UB0GVCTbiCVmONkA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"6748987e-8832-4032-93f0-e2280d98a21b","compromised-third-party-aws-credentials-enable-multi-tenant-cloud-breach","d5a6eb97-42a6-42b2-9271-bfb9c981b104","Compromised Third-Party AWS Credentials Enable Multi-Tenant Cloud Breach","Attackers compromised IAM users within Qubole, a cloud data platform, and leveraged trusted role-assumption relationships to pivot into dozens of customer AWS accounts — a classic supply chain trust abuse. The root failure was the existence of overly permissive cross-account IAM roles that allowed a compromised vendor identity to reach customer environments without additional verification. Tools like TruffleHog were used to harvest embedded secrets from accessible resources, amplifying the damage once initial access was gained. This incident illustrates how third-party cloud integrations can silently expand your attack surface, turning a vendor's breach into your own data exfiltration event.","**Immediate actions:**\n- Audit and revoke all cross-account IAM roles granted to third-party vendors, re-issuing only the minimum permissions required.\n- Rotate all AWS IAM credentials and secrets for accounts that had any trust relationship with Qubole.\n- Enable AWS CloudTrail and GuardDuty across all accounts to detect anomalous role assumption and S3 data access.\n\n**Long-term improvements:**\n- Apply least-privilege principles to all cross-account IAM roles and enforce permission boundaries to limit blast radius.\n- Establish a formal third-party cloud access review process, including periodic re-certification of all vendor-assumed roles.\n- Use AWS Service Control Policies (SCPs) to restrict which external principals can assume roles within your organization.\n\n**Detection measures:**\n- Alert on unusual `sts:AssumeRole` activity originating from third-party account IDs, especially outside business hours.\n- Monitor S3 bucket access logs for large-volume or bulk `GetObject` operations and trigger automated incident workflows on anomalies.\n- Deploy secrets-scanning pipelines (similar to TruffleHog) internally to identify and remediate exposed credentials before attackers find them.",[12,13,14,15,16],"NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","NIS2 Article 21(2)(d)","MITRE ATT&CK T1199: Trusted Relationship",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 AC-6: Least Privilege":19,"NIST SP 800-53 AC-2: Account Management":20,"MITRE ATT&CK T1199: Trusted Relationship":21,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":22},"NIS2's supply chain security point requires entities to assess and manage the security risks introduced by third-party service providers, directly applicable to trusting a vendor's IAM identity with cross-account access.","AC-6 mandates that accounts and roles operate with the minimum permissions necessary, limiting how much of a customer environment an attacker could access after assuming a compromised vendor role.","AC-2 requires organizations to manage and monitor accounts granted to external parties, which would have prompted regular review and tightening of the cross-account IAM roles Qubole customers had provisioned.","This technique describes adversaries exploiting trusted third-party connections to gain access to target environments, which is precisely how the attacker used Qubole's compromised IAM identity to pivot into customer accounts.","This control requires organizations to define and monitor security requirements for supplier access, which would have included controls over what cross-account AWS permissions Qubole was granted.","published","2026-11-10T20:20:43.379094+00:00","2026-11-10T20:20:43.362+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-trusted-aws-access-to-breach-multiple-cloud-environments\u002F","hackers-exploit-trusted-aws-access-to-breach-multiple-cloud-environments-ddf41e","Hackers exploit trusted AWS access to breach multiple cloud environments",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":54,"name":55,"problem":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]