{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/qubole/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS","Qubole platform"],"_cs_severities":["high"],"_cs_tags":["supply-chain-attack","cloud-security","credential-harvesting"],"_cs_type":"advisory","_cs_vendors":["Amazon","Qubole"],"content_html":"\u003cp\u003eBetween October 14 and October 26, 2026, a threat actor utilized IAM credentials associated with the Qubole platform (AWS account 805246085872) to perform unauthorized AssumeRole operations in customer AWS environments. The attacker performed reconnaissance, harvested credentials from AWS services (Lambda, Secrets Manager, SSM Parameter Store), and exfiltrated S3 data. Evidence suggests the actor used a malicious ISO image (sso_agent.iso) for potential post-exploitation, and utilized TruffleHog to validate stolen credentials across AWS, Entra ID, and Okta.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eCompromise of IAM credentials (AIDA3W7DIFLYOLTK63SFS or AIDAJYRRH5Y3A7AAJM2HW) within Qubole's AWS account.\u003c/li\u003e\n\u003cli\u003eInitial access via AssumeRole requests to customer integration roles originating from non-AWS infrastructure (Mullvad VPN, OVH VPS).\u003c/li\u003e\n\u003cli\u003eDiscovery of environment resources using session names prefixed with \u0026quot;quiam-\u0026quot;.\u003c/li\u003e\n\u003cli\u003eCredential harvesting from Lambda environment variables, Secrets Manager, and SSM Parameter Store.\u003c/li\u003e\n\u003cli\u003eValidation of harvested credentials using TruffleHog (e.g., AWS GetCallerIdentity).\u003c/li\u003e\n\u003cli\u003eExfiltration of S3 bucket contents.\u003c/li\u003e\n\u003cli\u003eStaging of a malicious ISO (sso_agent.iso) on external infrastructure for potential system-level persistence.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eConfirmed unauthorized access to customer AWS environments, enumeration of cloud configurations, harvesting of secrets and credentials (AWS, Entra ID, Okta), and potential exfiltration of S3 data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReview CloudTrail logs for AssumeRole events where the source identity account is 805246085872 and the source IP originates from outside AWS infrastructure.\u003c/li\u003e\n\u003cli\u003eAudit existing cross-account IAM roles for Qubole integrations to ensure they are still required and correctly scoped with specific External IDs.\u003c/li\u003e\n\u003cli\u003eRotate any credentials or secrets identified in environments where Qubole integration roles were active during the period of interest.\u003c/li\u003e\n\u003cli\u003eDeploy detection for role session names starting with \u0026quot;quiam-\u0026quot;.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T18:35:25Z","date_published":"2026-11-09T16:09:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-qubole-cross-account-abuse/","summary":"A threat actor leveraged compromised IAM credentials from a Qubole AWS account to assume customer integration roles, facilitating wide-scale resource discovery, credential harvesting, and S3 data exfiltration.","title":"Qubole: Unauthorized cross-account IAM role assumption","url":"https://feed.craftedsignal.io/briefs/2026-11-qubole-cross-account-abuse/"}],"language":"en","title":"CraftedSignal Threat Feed - Qubole","version":"https://jsonfeed.org/version/1.1"}