[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fom8yBq-W46UeUF19CnwprLVyYj4WvU0DoAygG4cPjw8":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"38c058bc-7eb0-4eb9-bace-cd2ad0c1f074","Attackers backdoor trusted AWS integrations to steal secrets","attackers-backdoor-trusted-aws-integrations-to-steal-secrets-4c2a67","Wiz researchers uncovered the secret-stealing supply-chain attack","Unknown attackers compromised IAM credentials associated with Qubole's AWS account and exploited cross-account trust relationships to access multiple customer AWS environments, stealing secrets from S3 buckets, Lambda, Secrets Manager, and SSM Parameter Store. Wiz researchers, working with Google Mandiant, traced the malicious activity back to October 14, revealing the threat actors used TruffleHog to test credentials and harvest OAuth tokens from Okta and Microsoft Entra ID. The campaign affected multiple organizations that had integrated with Qubole and failed to revoke deprecated trust policies.","Attackers abuse compromised Qubole AWS credentials to steal secrets from customer environments via supply-chain attack.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F09\u002Fattackers-backdoor-trusted-aws-integrations-to-steal-secrets\u002F5308553","https:\u002F\u002Fimage.theregister.com\u002F?imageId=1681829&width=800","2026-11-09T19:59:50+00:00","2026-11-09T20:00:24.27596+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Qubole","vendor",{"name":21,"type":19},"Amazon Web Services (AWS)",{"name":23,"type":19},"Google",{"name":25,"type":19},"Wiz",{"name":27,"type":19},"Mandiant",{"name":29,"type":19},"Microsoft","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[52],{"type":53,"value":54,"context":55},"malware","TruffleHog","Credential scanning tool used to test AWS credentials and discover secrets",[23,29,18],{"controls":58,"vendors":144},[59,87,115],{"slug":60,"name":61,"problem":62,"products":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[64,72,79],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":60,"product_name":76,"url":77,"description":78},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":88,"name":89,"problem":90,"products":91},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[92,100,107],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":101,"vendor_name":29,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":116,"name":117,"problem":118,"products":119},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",[145,150],{"slug":146,"name":23,"logo_path":147,"roles":148},"google","\u002Fvendor-logos\u002Fgoogle.png",[149],"reported_by",{"slug":151,"name":25,"logo_path":152,"roles":153},"wiz","\u002Fvendor-logos\u002Fwiz.png",[149],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"compromised-third-party-iam-credentials-enable-cross-account-aws-secret-theft","Compromised Third-Party IAM Credentials Enable Cross-Account AWS Secret Theft","Attackers compromised IAM credentials belonging to Qubole, a trusted AWS integration partner, and leveraged cross-account trust relationships to pivot into multiple customer AWS environments. The root failure was twofold: Qubole's credentials were inadequately protected, and customer organizations never revoked deprecated trust policies after they were no longer needed. This matters because third-party integrations extend your attack surface beyond your own perimeter — an adversary who owns a trusted partner effectively owns a door into your environment. The theft of secrets from S3, Lambda, Secrets Manager, and SSM Parameter Store demonstrates how over-privileged, stale cross-account roles amplify the blast radius of a single supplier compromise.",[159,160,161,162,163,164,165],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 5: Account Management","CIS Control 15: Service Provider Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1199: Trusted Relationship","GDPR Article 32",{"GDPR Article 32":167,"CIS Control 5: Account Management":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"MITRE ATT&CK T1199: Trusted Relationship":170,"CIS Control 15: Service Provider Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"Article 32 requires appropriate technical measures to ensure ongoing confidentiality of personal data; the theft of secrets from S3 buckets and Secrets Manager in environments likely containing personal data represents a failure of this obligation, particularly for the organizations that neglected to revoke third-party access.","Regular review and removal of unused or deprecated accounts and trust relationships — a core CIS Control 5 requirement — would have eliminated the stale cross-account IAM roles that attackers exploited to pivot across customer AWS environments.","Treating deprecated trust policies and stale IAM credentials as remediable security flaws — with defined timelines for removal — falls under flaw remediation processes that SI-2 mandates for information systems.","The attackers explicitly weaponized Qubole's trusted cross-account relationship to gain initial access to customer environments, which is precisely the technique T1199 describes — adversaries abusing third-party trust to bypass perimeter controls.","CIS Control 15 requires organizations to inventory, monitor, and assess the security posture of third-party service providers; had customers applied this control to Qubole, they would have been positioned to detect or limit the blast radius of the supplier compromise.","While credential-based, the core issue includes misconfigured and unreviewed trust policies that represent a known configuration vulnerability; systematic vulnerability management of IAM configurations would have surfaced these risks before exploitation.","This control directly addresses the need to manage cross-account trust relationships and enforce least-privilege access — the stale, over-privileged trust policies that Qubole customers left in place were the primary vector for lateral movement into their environments."]