[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXiXpgjQmBAyIgHnkas6WvPn5Wx-PV2wR9DvL89DNXSI":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"f5146fef-336c-4f4b-8bdd-c2615591995f","Trusted by Default: Qubole Cross-Account Access Abused in the Wild","trusted-by-default-qubole-cross-account-access-abused-in-the-wild-ee49f6","A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it.","A threat actor exploited IAM credentials from Qubole's AWS account to assume integration roles in multiple customer AWS environments between October 14-26, 2026. The actor enumerated resources, accessed S3 data, and harvested credentials. This supply chain attack was detected by Sentra and investigated by Wiz.","Threat actor abuses Qubole's AWS account to access customer cloud environments.","https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fqubole-cross-account-access-abused-in-the-wild","https:\u002F\u002Fwww.datocms-assets.com\u002F75231\u002F1794234152-2.png","2026-11-09T14:56:32+00:00","2026-11-09T16:00:26.66866+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Qubole","product",{"name":21,"type":22},"Wiz","vendor",{"name":24,"type":22},"Sentra",{"name":26,"type":27},"AWS","technology",{"name":29,"type":27},"IAM","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,38,43,48],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,61],{"type":55,"value":56,"context":57},"ip","45.83.220.211","Mullvad VPN IP used for initial AssumeRole calls.",{"type":55,"value":59,"context":60},"57.129.54.120","OVH VPS IP used for subsequent AssumeRole calls.",{"type":55,"value":62,"context":63},"185.209.199.73","Second Mullvad VPN IP used for AssumeRole calls.",[21,24,18],{"controls":66,"vendors":149},[67,95,124],{"slug":68,"name":69,"problem":70,"products":71},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":68,"product_name":92,"url":93,"description":94},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":96,"name":97,"problem":98,"products":99},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":125,"name":126,"problem":127,"products":128},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[129,136,141],{"vendor_slug":130,"vendor_name":21,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":137,"product_name":138,"url":139,"description":140},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",[150],{"slug":130,"name":21,"logo_path":131,"roles":151},[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"qubole-iam-credential-abuse-exposes-customer-aws-environments-via-cross-account-trust","Qubole IAM Credential Abuse Exposes Customer AWS Environments via Cross-Account Trust","A threat actor compromised IAM credentials within Qubole's AWS account and exploited pre-existing cross-account integration roles to gain unauthorized access to multiple customer AWS environments. This is a textbook supply chain attack: customers implicitly trusted Qubole's account, and that trust was weaponized to enumerate resources, exfiltrate S3 data, and harvest further credentials. The core failure was an overly permissive, insufficiently monitored trust relationship between Qubole and its customers. It matters because a single vendor compromise cascaded into breaches across many organizations that had no direct vulnerability of their own.",[158,159,160,161,162,163,164],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 5: Account Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 18: Penetration Testing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":166,"CIS Control 5: Account Management":167,"CIS Control 18: Penetration Testing":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"CIS Control 17: Incident Response Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 Article 21(2)(b) requires supply chain security measures including controls over third-party service provider access; the absence of such controls allowed a vendor-side compromise to directly propagate into customer environments.","CIS Control 5 mandates managing the lifecycle of all accounts including service and third-party integration accounts; enforcing least-privilege and reviewing cross-account roles would have prevented the attacker from assuming overly permissive customer roles.","Regular penetration testing of the cloud environment and third-party integration points would have identified the exploitable cross-account role trust relationships before a real attacker did.","While this is a configuration and trust abuse issue rather than a software flaw, SI-2's principle of promptly identifying and correcting weaknesses applies directly to remediating misconfigured or over-permissive IAM trust relationships before they are exploited.","The attack spanned 12 days before detection by a third party (Sentra\u002FWiz), highlighting that neither Qubole nor its customers had effective incident response procedures to detect and contain the cross-account abuse in a timely manner.","Overly broad cross-account IAM permissions represent a known configuration vulnerability; ISO 27001 A.8.8 requires organizations to identify and remediate such vulnerabilities, which a periodic cloud posture review would have surfaced.","This incident stemmed from unconstrained cross-account IAM trust; PR.AA requires that access permissions be managed, enforced, and reviewed to ensure only authorized identities can access resources — a control that would have limited the blast radius of the vendor compromise."]