Attackers abuse Qubole’s trusted AWS account to raid customers’ cloud data
Hackers used credentials from Qubole’s trusted Amazon Web Services account to break into several customers’ environments, stealing cloud and identity credentials, secrets and S3 data.
A compromise at cloud data platform Qubole has spilled over into the Amazon Web Services environments of multiple customers, underscoring how attackers now target the connective tissue between providers and clients.
According to a detailed technical report, unknown hackers obtained credentials for Qubole’s trusted AWS account and used them to access several customers’ AWS accounts. Once inside, they stole AWS credentials, identity provider credentials, various secrets and data stored in Amazon S3 buckets. The report did not name the affected organizations.
Qubole’s service typically relies on a trust relationship between its AWS account and a customer’s account so it can launch compute clusters and work with stored data. That integration became the attackers’ route in once the Qubole side was breached.
For victim organizations, the immediate concern is where those stolen credentials and secrets can be reused. Identity provider logins may open access to other cloud applications. Keys and tokens from AWS can in turn unlock downstream services, databases or internal tools.
Security teams responding to the incident are being advised to rotate credentials, revoke trust relationships where necessary, review audit logs and check for data exfiltration beyond what’s already been confirmed.
The Qubole breach fits a wider pattern of attacks that focus on service providers and software supply chains. In a separate, same‑day case, hackers compromised Ethersphere’s bee‑js npm package and its Swarm Desktop app so they could deliver crypto‑wallet‑stealing malware and install backdoors on Windows, macOS and Linux. Both the malicious bee‑js releases and the affected Swarm Desktop version have since been withdrawn, but updating alone will not remove the backdoors already planted on infected systems.
These incidents show how a single compromised integration point or software dependency can give attackers reach into many organizations at once. Over the coming days, disclosures from Qubole, its customers or regulators will clarify the scope of data exposure and may prompt broader reviews of how cross‑account trust is configured in cloud environments.
Sources
- OSINT