Qubole: Unauthorized cross-account IAM role assumption

Between October 14 and October 26, 2026, a threat actor utilized IAM credentials associated with the Qubole platform (AWS account 805246085872) to perform unauthorized AssumeRole operations in customer AWS environments. The attacker performed reconnaissance, harvested credentials from AWS services (Lambda, Secrets Manager, SSM Parameter Store), and exfiltrated S3 data. Evidence suggests the actor used a malicious ISO image (sso_agent.iso) for potential post-exploitation, and utilized TruffleHog to validate stolen credentials across AWS, Entra ID, and Okta.

Attack Chain

1. Compromise of IAM credentials (AIDA3W7DIFLYOLTK63SFS or AIDAJYRRH5Y3A7AAJM2HW) within Qubole's AWS account.
2. Initial access via AssumeRole requests to customer integration roles originating from non-AWS infrastructure (Mullvad VPN, OVH VPS).
3. Discovery of environment resources using session names prefixed with "quiam-".
4. Credential harvesting from Lambda environment variables, Secrets Manager, and SSM Parameter Store.
5. Validation of harvested credentials using TruffleHog (e.g., AWS GetCallerIdentity).
6. Exfiltration of S3 bucket contents.
7. Staging of a malicious ISO (sso_agent.iso) on external infrastructure for potential system-level persistence.

Impact

Confirmed unauthorized access to customer AWS environments, enumeration of cloud configurations, harvesting of secrets and credentials (AWS, Entra ID, Okta), and potential exfiltration of S3 data.

Recommendation

• Review CloudTrail logs for AssumeRole events where the source identity account is 805246085872 and the source IP originates from outside AWS infrastructure.
• Audit existing cross-account IAM roles for Qubole integrations to ensure they are still required and correctly scoped with specific External IDs.
• Rotate any credentials or secrets identified in environments where Qubole integration roles were active during the period of interest.
• Deploy detection for role session names starting with "quiam-".