Wiz links stolen AWS credentials to compromised Qubole integrations

Attackers used compromised credentials linked to Qubole’s AWS account to enter customer cloud environments and steal secrets and data, according to The Register’s account of research by Wiz. The report gives affected organisations specific steps to investigate and contain the access, but does not establish how many were hit.

Watch Desk analysis

What happened

Wiz told The Register that attackers abused cross-account IAM roles used by Qubole integrations. The activity began on 14 October, the researchers said, and involved calls to AWS’s AssumeRole service using credentials associated with Qubole’s account. Once inside customer environments, the attackers searched AWS services including Secrets Manager, Systems Manager Parameter Store, Lambda and S3, and stole credentials and other data.

Wiz described the campaign as broad and opportunistic but did not give The Register a victim count. The publication says AWS and Qubole did not respond to its enquiries. Wiz also identified a separate earlier campaign involving customer-owned Qubole integration keys, but could not definitively connect it to this activity.

Why it matters

The weak point was a trust relationship left active after some organisations had stopped using the integration. That meant credentials associated with a third party could be used to assume customer-managed roles and reach cloud resources. The incident is a reminder that retiring a service should include removing its access, not merely crossing it off the procurement list.

The researchers’ advice is concrete: organisations that integrated with Qubole should rotate credentials and review AWS CloudTrail logs from 1 October onwards for AssumeRole events involving account 805246085872, particularly those originating from non-AWS IP addresses. They also advise tracing activity from each role session, rotating any secrets the role could read and revoking active sessions. Rotating credentials alone will not end temporary sessions that have already been issued.

Our read

This is a useful security warning because it comes with a route to check exposure, not just a grim recital of cloud-service names. Teams should treat old integrations as live access until they have checked the relevant trust policies, credentials and logs. The missing victim count matters: the report describes multiple affected environments, but does not show how widespread the compromise is.

What to watch

• Whether AWS or Qubole provides further information or guidance.
• Whether Wiz or another party publishes a clearer account of the number of affected organisations.
• Whether follow-up reporting connects the separate October activity to this campaign.

Discussion spark: Should cloud providers require customers to periodically re-confirm third-party access, or should removing unused integrations remain solely the customer’s responsibility?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.