Between October 14 and October 26, 2026, a threat actor exploited IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. The attacker used multiple IAM users and VPN addresses to conduct extensive reconnaissance, including enumerating storage, databases, and identity resources. Credentials were harvested from Lambda environment variables, Secrets Manager, and SSM Parameter Store, then validated with TruffleHog. Data was opportunistically exfiltrated from S3 buckets accessible to the assumed roles. A suspicious bootable Linux ISO image intended for remote deployment and system reconnaissance was also identified. The campaign exploited trusted cross-account relationships that remained active despite many integrations being unused and appears opportunistic rather than state-sponsored.