NewsPublished 10 Nov 2026

Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Source SecurityWeek

supply-chain

Description

A threat actor exploited compromised IAM credentials associated with Qubole's AWS account to access and steal data from over a dozen organizations. The attackers assumed cross-account IAM roles that were still active despite some companies no longer using Qubole, allowing them to enumerate resources, collect secrets, and exfiltrate data from AWS S3 buckets. The campaign occurred between October 14 and October 26, 2026, and involved opportunistic data theft rather than targeted espionage. No evidence was found of deployment of a discovered ISO file designed for remote data harvesting. A separate related campaign tested customer-owned AWS keys for compromise between October 8 and 11, 2026. The attack originated from rented servers and VPNs, not Qubole's network.

Impact

The attackers gained unauthorized access to sensitive data including customer files, secrets, keys, environment variables, and credentials from multiple organizations' AWS environments. The compromised roles allowed broad read access, enabling the theft of entire S3 buckets in some cases. This exposure could lead to data breaches, loss of confidentiality, and potential downstream impacts depending on the nature of the stolen data. The opportunistic nature of the attack suggests a wide-ranging impact across affected organizations without specific targeting.

Defensive guidance

The vendor does not appear to have issued a direct advisory or patch related to this incident. Organizations should immediately audit and revoke any unused or stale cross-account IAM roles associated with Qubole or similar third-party services. Customers should ensure that roles granted to external vendors are removed promptly when no longer needed. Implement strict IAM role lifecycle management and monitor for unusual role assumption activity. Rotate credentials and secrets that may have been exposed. Since this is a cloud environment issue, remediation is primarily customer-driven through AWS IAM best practices and role management.

Summary

Cybersecurity researchers discovered that attackers used compromised IAM credentials for Qubole's AWS account to assume cross-account IAM roles set up by customers. These roles, which remained active after some customers ceased using Qubole, permitted the attackers to access AWS environments of over a dozen organizations. The attackers enumerated AWS resources, harvested secrets and configurations, and exfiltrated data from S3 buckets opportunistically. The attack campaign ran from October 14 to October 26, 2026, with activity traced to rented OVH servers and Mullvad VPNs. The attackers used consistent role session naming conventions and leveraged tools such as TruffleHog to test credentials. No direct evidence links this campaign to state-sponsored activity or other known campaigns. Additionally, a separate campaign tested customer-owned AWS keys for potential compromise earlier in October 2026.

References

securityweek.com/over-a-dozen-organizations-hit-in-qubole-supply-chain-attack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Nov 2026, 13:33 UTC

Technical details

References

Community reviews

Related threats