Qubole AWS Cross-Account Flaw: Detection & Mitigation Guide

At-A-Glance Incident Diagnostic Telemetry

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

A sophisticated supply-chain attack uncovered by Wiz researchers involved threat actors exploiting a cross-account access vulnerability in Qubole's AWS integration. Attackers leveraged compromised IAM credentials associated with Qubole's AWS account (ID: 805246085872) to assume customer-managed integration roles. Operating primarily between October 14 and 26 via OVH-hosted VPS infrastructure (57.129.54[.]120) and Mullvad VPN, the actors probed AWS services, harvested secrets from Lambda, Secrets Manager, and SSM Parameter Store, and exfiltrated data from S3 storage.

The threat actor utilized specific role session naming conventions such as 'quiam-enum' and 'quiam-scope-full', subsequently deploying TruffleHog to test credentials and enumerate cloud services. Additionally, attackers targeted Microsoft Entra ID secrets and Okta client credentials found within the environment. The campaign affected over a dozen organizations, though exact motivations remain unconfirmed.

2. Business Impact & Perimeter Exposure

The compromise of customer-managed integration roles allowed unauthorized lateral movement across multiple cloud tenancies. Attackers achieved wide read access to sensitive corporate data stored in S3, posing extreme risks of proprietary data exposure, regulatory non-compliance, and secondary attacks using harvested API keys and secrets.

3. Compliance & Governance Blast Radius

The unauthorized access and data exfiltration from customer S3 buckets trigger severe regulatory compliance obligations, including mandatory disclosures under GDPR Article 33 and various regional data protection frameworks. Organizations must perform immediate impact assessments.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The core vector relied on lingering, unmonitored cross-account IAM trust policies established for Qubole's AWS integration. Because many organizations left trust relationships active long after deprecating the platform, adversaries were able to issue sts:AssumeRole API calls directly into customer environments using compromised Qubole infrastructure credentials.

Once inside, actors systematically enumerated AWS resources, executing TruffleHog to validate extracted credentials. To maintain persistence or gather host telemetry in certain segmented edge scenarios, operators occasionally utilized bootable Linux images (sso_agent.iso) designed to execute within 90-minute intervals before triggering hard reboots that scrub forensic artifacts.

Adversary Ingress & Lateral Traversal Pipeline

Attackers bypassed perimeter defenses by exploiting legitimate cloud integration channels rather than traditional host-based vulnerabilities. By assuming Qubole integration roles, they accessed common credential repositories—including AWS Lambda environment variables, Secrets Manager, SSM Parameter Store, and S3 buckets—downloading entire storage containers within single active sessions.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Exploitation Telemetry

The campaign exhibits high operational awareness of cloud IAM mechanics but does not align with established state-sponsored playbooks. The opportunistic targeting of multiple disconnected organizations indicates a financially motivated or espionage-neutral reconnaissance phase.

---

Detection & SOC Mitigation Playbook

1. AWS CloudTrail Log Review & Hunting

Search CloudTrail logs for AssumeRole events originating from Qubole's AWS account ID (805246085872) and inspect associated session names (quiam-enum, quiam-scope-full).

2. Sigma Detection Rule

title: Qubole AWS Supply Chain Attack
description: Detects potential malicious activity related to the Qubole AWS supply chain attack
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    - userIdentity.accountId: '805246085872'
    - eventName: AssumeRole
  condition: selection

3. Microsoft Sentinel KQL Hunting Query

let QuboleAccountId = '805246085872';
AzureDiagnostics
| where ResourceProvider == 'Microsoft.CloudTrail' and OperationName == 'AssumeRole'
| where CallerAccountId == QuboleAccountId
| project TimeGenerated, CallerAccountId, OperationName, TargetResource

4. Remediation & Verification Checklist

• Review CloudTrail logs from October 1 onward across all AWS accounts maintaining integration roles.
• Rotate every secret, parameter, SSM value, and Lambda environment variable accessible by the integration role.
• Remove trust policies for third-party integrations no longer actively utilized.
• Narrow trusted principals and enforce strict boundary conditions on all cross-account roles.
• Revoke all active sessions and tokens associated with compromised integration roles.

---

Indicators of Compromise (IOCs)

---

Frequently Asked Questions (FAQ)

1. Is Qubole actively exploited in the wild?

Yes, threat intelligence telemetry confirms active exploitation targeting customer integration roles between October 14 and 26.

2. Which systems, applications, and perimeters are affected?

Cloud tenancies, specifically AWS accounts utilizing unmonitored or deprecated cross-account integration roles associated with Qubole, are directly impacted.

3. What immediate remediation should organizations deploy today?

Audit CloudTrail for AssumeRole events from Qubole's account, rotate all exposed secrets, and delete unused cross-account trust relationships.

4. How can security operations teams detect and hunt for this threat?

Security teams should deploy the provided Sigma rules and KQL hunting queries to analyze historical CloudTrail logs for unauthorized role assumption and credential harvesting patterns.