Stolen Qubole AWS Credentials Opened Cloud Environments at More Than a Dozen Organizations
A threat actor used stolen credentials tied to Qubole's Amazon Web Services account to enter cloud environments at more than a dozen organizations, according to separate investigations by Sentra and Wiz. The incident shows how vendor access can remain a viable attack path long after a commercial relationship changes.
The attacker entered through cross-account AWS Identity and Access Management roles that customers had previously granted to Qubole. Some of those roles remained active even after the organizations stopped using the data platform. Sentra said the actor could begin assuming trusted roles within minutes of obtaining the vendor credentials.
Once inside, the intruder enumerated cloud resources and collected data from Amazon S3 along with secrets stored in AWS Secrets Manager, Systems Manager Parameter Store, Lambda functions and EC2 user data. Sentra reported that millions of files were downloaded from one environment. Wiz said the broader activity ran from October 14 through October 26, 2026.
The campaigns were designed for collection rather than disruption. Investigators said the attacker made no writes in the affected environments, a tactic that can reduce the chance of setting off controls focused on configuration changes.
Sentra said it alerted Wiz after identifying the activity, and the companies investigated with Mandiant. The findings reinforce a familiar cloud security problem: a trusted external role can outlive the business purpose that justified it.
Security teams should inventory cross-account trust relationships, remove dormant vendor roles, narrow permissions and monitor role assumption from unfamiliar infrastructure. Rotating vendor credentials alone is not enough if old trust policies continue to grant broad access.
