Trusted by Default: Qubole Cross-Account Access Abused in the Wild

Between October 14 and October 26, 2026, a threat actor exploited IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. The attacker used multiple IAM users and VPN addresses to conduct extensive reconnaissance, including enumerating storage, databases, and identity resources. Credentials were harvested from Lambda environment variables, Secrets Manager, and SSM Parameter Store, then validated with TruffleHog. Data was opportunistically exfiltrated from S3 buckets accessible to the assumed roles. A suspicious bootable Linux ISO image intended for remote deployment and system reconnaissance was also identified. The campaign exploited trusted cross-account relationships that remained active despite many integrations being unused and appears opportunistic rather than state-sponsored.

• On the hunt for ARTEX: understanding agentic attacks in AWS environmentsMalware2026-11-09
• U.S. urges critical infrastructure orgs to secure refrigeration systems ASAP after EU supermarket and blood bank attacksCriticalVulnerability2026-11-09
• 9th November · Threat Intelligence ReportAnalysis2026-11-09
• Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsMalware2026-11-09
• Hacking on Autopilot: Inside ARTEX Cybercrime CampaignsCampaign2026-11-05