[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYbXxFyozCnefYMVtoopNUunevmB3JYwxBIfeUX2Kdbw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"3bb06692-4374-4909-94e7-bcd659fd9ed1","quboles-trusted-aws-credentials-weaponized-to-breach-customer-accounts","f0d294c2-a1de-497e-9655-579e386ed93f","Qubole's Trusted AWS Credentials Weaponized to Breach Customer Accounts","Attackers exploited the inherent trust relationship between Qubole's data platform and its customers' AWS environments, using Qubole's own credentials to pivot laterally into multiple customer accounts and steal sensitive data. This is a classic supply chain attack: the vendor became the attack vector, bypassing any security controls the customers had in place individually. The fact that Qubole's credentials provided broad enough access to steal secrets and data suggests insufficient application of least-privilege principles in the cross-account trust model. Organizations that grant third-party vendors standing access to cloud environments face compounded risk when that vendor is compromised. This incident underscores why third-party access must be tightly scoped, continuously monitored, and subject to rigorous credential hygiene.","**Immediate actions:**\n- Rotate all AWS cross-account credentials shared with third-party vendors and enforce short-lived, role-based tokens (e.g., AWS STS AssumeRole) instead of long-lived keys.\n- Audit all existing third-party IAM roles and permissions to verify they follow least-privilege principles and revoke any unnecessary access immediately.\n\n**Long-term improvements:**\n- Implement a formal Third-Party Risk Management (TPRM) program that requires vendors to demonstrate credential hygiene, MFA enforcement, and periodic security assessments before granting cloud access.\n- Enforce time-bound, just-in-time (JIT) access for all third-party integrations so vendor credentials cannot be used outside approved maintenance windows.\n- Require contractual obligations for vendors to disclose credential compromise events within a defined SLA (e.g., 24 hours).\n\n**Detection measures:**\n- Enable AWS CloudTrail and GuardDuty across all accounts to alert on anomalous cross-account API calls originating from vendor-associated roles.\n- Set up automated alerts for bulk data reads or secrets access (e.g., AWS Secrets Manager, SSM Parameter Store) from third-party IAM roles to detect exfiltration early.",[12,13,14,15,16,17,18],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":20,"NIS2 Article 21(2)(b)":21,"MITRE ATT&CK T1566: Phishing":22,"CIS Control 5: Account Management":23,"NIST SP 800-53 SI-2: Flaw Remediation":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Customer data was stolen via a third-party processor (Qubole), triggering obligations under Article 32 to ensure processors implement appropriate technical measures—including access controls—to protect personal data.","NIS2 explicitly requires supply chain security measures including controls over third-party service relationships; Qubole's trusted access without adequate safeguards is precisely the risk this article targets.","While the exact method is undisclosed, credential theft from a SaaS vendor commonly involves phishing of vendor employees, making this technique relevant as a likely initial access vector.","Qubole's standing, likely over-privileged AWS credentials gave attackers broad access; enforcing least-privilege and eliminating long-lived third-party credentials directly addresses this failure.","While the credential theft vector is unknown, robust supply chain security practices under SI-2 require organizations to assess and remediate weaknesses in vendor-provided services that could expose customer environments.","Supplier access credentials represent a technical vulnerability surface; regular review and hardening of third-party access configurations would have reduced the attack's blast radius.","The breach hinged on compromised third-party credentials with excessive trust; this framework control mandates that access be granted on a least-privilege basis with strong identity verification, which would have limited the attacker's reach.","published","2026-11-09T19:22:07.923433+00:00","2026-11-09T19:22:07.901+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fhackers-exploit-quboles-trusted-aws.html","hackers-exploit-qubole-s-trusted-aws-access-to-breach-customer-accounts-and-stea-ee5e2c","Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":54,"name":55,"problem":56},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":58,"name":59,"problem":60},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files."]