[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ff_D8XR_07hUscQpF2-fXTbS4kYG1o6GuA6o_8oOtt5Q":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"5f511364-1ba2-4da5-9bda-6095130b55e8","Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets","hackers-exploit-trusted-qubole-iam-roles-to-access-aws-accounts-and-download-ent-32f681","Hackers abused trusted Qubole integrations to enter customer AWS accounts, steal secrets, and download data from Amazon S3, sometimes taking entire buckets in one session. The activity ran from October 14 through October 26, 2026, using IAM credentials from an AWS account associated with Qubole rather than exploiting a software vulnerability. The attackers relied on […] The post Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets appeared first on Cyber Security News.","Attackers leveraged trusted Qubole integrations to access customer AWS accounts, steal secrets, and download data from S3 buckets between October 14-26, 2026. The campaign utilized IAM credentials from a Qubole-associated AWS account, exploiting existing permissions granted to the data processing platform rather than a software vulnerability. Researchers from Wiz.io, Sentra, and Mandiant investigated the activity, noting that compromised roles remained accessible even after integrations were inactive.","Hackers exploited Qubole IAM roles to access AWS accounts and download S3 buckets.","https:\u002F\u002Fcybersecuritynews.com\u002Fqubole-iam-roles\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Exploit-Trusted-Qubole-IAM-Roles-to-Access-AWS-Accounts-and-Download-Entire-S3-Buckets.webp","2026-11-10T13:26:51+00:00","2026-11-10T14:00:28.466518+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Qubole","product",{"name":21,"type":19},"AWS",{"name":23,"type":19},"Amazon S3",{"name":25,"type":19},"Microsoft Entra ID",{"name":27,"type":19},"Okta",{"name":29,"type":19},"TruffleHog","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":32,"name":33,"slug":34},null,"Threat Intelligence","threat-intelligence",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":52},{"id":30,"icon":32,"name":33,"slug":34},[],[18,21,23],{"controls":56,"vendors":143},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":87,"name":88,"problem":89,"products":90},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[91,99,106],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":100,"vendor_name":27,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":115,"name":116,"problem":117,"products":118},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",[144,150],{"slug":145,"name":146,"logo_path":147,"roles":148},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[149],"reported_by",{"slug":128,"name":129,"logo_path":130,"roles":151},[149],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":162},"stale-third-party-iam-trust-relationships-exploited-to-drain-aws-s3-buckets","Stale Third-Party IAM Trust Relationships Exploited to Drain AWS S3 Buckets","Attackers abused IAM roles that customers had previously granted to Qubole, a third-party data platform, to access AWS accounts without exploiting any software vulnerability — the permissions themselves were the attack surface. Because the trusted roles remained active even after Qubole integrations were no longer in use, adversaries had a persistent, legitimate-looking foothold to exfiltrate secrets and entire S3 buckets over nearly two weeks. This incident illustrates how third-party integrations silently accumulate excessive, long-lived cloud permissions that organizations rarely audit or revoke. The blast radius was amplified by the fact that IAM credentials associated with a vendor's AWS account — not the customer's own — were the initial vector, meaning customers had no visibility into the upstream compromise. Organizations must treat vendor-granted IAM trust relationships with the same rigor as direct employee access, enforcing least privilege and continuous lifecycle management.",[157,158,159,160,161],"CIS Control 5: Account Management (v8)","CIS Control 6: Access Control Management (v8)","NIST SP 800-53 AC-2: Account Management","NIS2 Article 21(2)(d)","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(d)":163,"MITRE ATT&CK T1078: Valid Accounts":164,"CIS Control 5: Account Management (v8)":165,"NIST SP 800-53 AC-2: Account Management":166,"CIS Control 6: Access Control Management (v8)":167},"NIS2 Article 21(2)(d) mandates supply chain security measures, requiring organizations to assess and manage the security risks introduced by third-party service providers such as Qubole.","The attackers used legitimate, pre-existing IAM credentials associated with the Qubole account to access customer environments, matching the Valid Accounts technique of abusing trusted credentials rather than exploiting a vulnerability.","CIS Control 5 requires inventorying and actively managing all accounts, including third-party and service accounts, which would have prompted timely revocation of the unused Qubole IAM trust relationships before they could be exploited.","AC-2 requires organizations to monitor, review, and disable accounts or access that are no longer needed, directly addressing the failure to revoke IAM trust relationships after Qubole integrations became inactive.","CIS Control 6 calls for enforcing least-privilege and regularly reviewing access rights, which would have limited the scope of permissions granted to the Qubole-associated IAM roles and reduced the data accessible during the breach."]