[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feyJnwcrr9Uhl7pUz7b6PdJvnyyAJZ5aTh-18qtsq6IY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"04b8d34e-7bd1-434a-a6e5-6235ea442c2c","compromised-third-party-iam-credentials-enable-cross-account-aws-secret-theft","38c058bc-7eb0-4eb9-bace-cd2ad0c1f074","Compromised Third-Party IAM Credentials Enable Cross-Account AWS Secret Theft","Attackers compromised IAM credentials belonging to Qubole, a trusted AWS integration partner, and leveraged cross-account trust relationships to pivot into multiple customer AWS environments. The root failure was twofold: Qubole's credentials were inadequately protected, and customer organizations never revoked deprecated trust policies after they were no longer needed. This matters because third-party integrations extend your attack surface beyond your own perimeter — an adversary who owns a trusted partner effectively owns a door into your environment. The theft of secrets from S3, Lambda, Secrets Manager, and SSM Parameter Store demonstrates how over-privileged, stale cross-account roles amplify the blast radius of a single supplier compromise.","**Immediate actions:**\n- Audit and revoke all deprecated or unused cross-account IAM trust policies in your AWS environment immediately.\n- Rotate any IAM credentials, OAuth tokens, and secrets that may have been exposed through Qubole or similar third-party integrations.\n- Enable AWS CloudTrail and Amazon GuardDuty to detect anomalous cross-account access patterns in real time.\n\n**Long-term improvements:**\n- Enforce least-privilege IAM policies for all third-party integrations, granting only the minimum permissions required for each specific function.\n- Implement a periodic (at minimum quarterly) review process to identify and remove stale cross-account trust relationships and unused IAM roles.\n- Adopt a formal third-party risk management program that requires suppliers to demonstrate credential hygiene and undergo security assessments before integration.\n\n**Detection measures:**\n- Deploy secrets scanning tooling (e.g., similar to TruffleHog used by attackers) proactively across your own repositories and configurations to find exposed credentials before adversaries do.\n- Set up alerts for unusual API calls to Secrets Manager, SSM Parameter Store, and S3 from cross-account principals or unfamiliar IAM entities.\n- Monitor Okta and Microsoft Entra ID logs for OAuth token issuance from unexpected sources or service accounts associated with third-party integrations.",[12,13,14,15,16,17,18],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 5: Account Management","CIS Control 15: Service Provider Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1199: Trusted Relationship","GDPR Article 32",{"GDPR Article 32":20,"CIS Control 5: Account Management":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"MITRE ATT&CK T1199: Trusted Relationship":23,"CIS Control 15: Service Provider Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 requires appropriate technical measures to ensure ongoing confidentiality of personal data; the theft of secrets from S3 buckets and Secrets Manager in environments likely containing personal data represents a failure of this obligation, particularly for the organizations that neglected to revoke third-party access.","Regular review and removal of unused or deprecated accounts and trust relationships — a core CIS Control 5 requirement — would have eliminated the stale cross-account IAM roles that attackers exploited to pivot across customer AWS environments.","Treating deprecated trust policies and stale IAM credentials as remediable security flaws — with defined timelines for removal — falls under flaw remediation processes that SI-2 mandates for information systems.","The attackers explicitly weaponized Qubole's trusted cross-account relationship to gain initial access to customer environments, which is precisely the technique T1199 describes — adversaries abusing third-party trust to bypass perimeter controls.","CIS Control 15 requires organizations to inventory, monitor, and assess the security posture of third-party service providers; had customers applied this control to Qubole, they would have been positioned to detect or limit the blast radius of the supplier compromise.","While credential-based, the core issue includes misconfigured and unreviewed trust policies that represent a known configuration vulnerability; systematic vulnerability management of IAM configurations would have surfaced these risks before exploitation.","This control directly addresses the need to manage cross-account trust relationships and enforce least-privilege access — the stale, over-privileged trust policies that Qubole customers left in place were the primary vector for lateral movement into their environments.","published","2026-11-09T20:20:24.828372+00:00","2026-11-09T20:20:24.804+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F09\u002Fattackers-backdoor-trusted-aws-integrations-to-steal-secrets\u002F5308553","attackers-backdoor-trusted-aws-integrations-to-steal-secrets-4c2a67","Attackers backdoor trusted AWS integrations to steal secrets",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"4bcbfc51-fbf1-4909-badf-a664c9188111","2026-11-10","morning","ThreatNoir Morning Brief — November 10","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-10\u002Fthreatnoir-morning-brief-2026-11-10.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":60,"name":61,"problem":62},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":64,"name":65,"problem":66},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files."]