Qubole Supply-Chain Attack Exposes Cloud Credentials Across Customer Environments

A supply-chain attack involving Qubole ran from October 14 through October 26, 2026, according to reporting by CSO Online based on research from Wiz, Sentra, and Mandiant. The attacker used credentials associated with Qubole’s AWS account to assume roles in customer environments that had established cross-account access to the platform. Sentra, which initially identified suspicious activity across several customer environments, said the campaign affected dozens of Qubole customers. The incident is not a federal contract award or solicitation, but it is material to government contractors that depend on external cloud platforms to process, store, or connect to sensitive information.

Qubole integrations rely on customers creating cross-account AWS Identity and Access Management (IAM) roles that identities from Qubole’s AWS account can assume. Those roles may use an External ID as an additional authorization check. Wiz reported that the attacker’s credentials could satisfy this requirement, and that all malicious role-assumption requests identified by researchers included the required External ID and succeeded. The activity illustrates how an integration can remain a viable route into a customer environment after the business relationship or active use of a platform has ended, if its permissions and trust relationships are not removed.

The reported activity began on October 14, when an IP address associated with Mullvad VPN attempted to assume customer integration roles from AWS account 805246085872, which Qubole uses for platform operations. The requests used IAM user AIDA3W7DIFLYOLTK63SFS. Most subsequent activity originated from an OVH-hosted virtual private server at 57.129.54[.]120. On October 18, the attacker began using a second IAM identity associated with Qubole’s AWS account, alongside another Mullvad VPN address. Many targeted roles had seen no legitimate Qubole activity during October, yet remained active and assumable.

After obtaining access, the attacker enumerated customer cloud resources, including S3 buckets, databases, EC2 instances, security groups, and IAM identities. The intruder also accessed AWS Secrets Manager, Systems Manager Parameter Store, and Lambda function configurations to retrieve credentials and other sensitive information. Data was downloaded from Amazon S3 after the attacker enumerated accessible buckets and objects; Wiz reported that entire buckets were downloaded in some individual sessions. Credentials found in compromised environments were subsequently tested using TruffleHog, including AWS access keys, Microsoft Entra ID service principal credentials, and Okta OAuth client credentials. For federal contractors, the procurement significance is operational: third-party integrations can create persistent paths to contract-related data, while exposed credentials may enable further access beyond the initial cloud account.

• The reported attack period was October 14–26, 2026; contractors should review AWS CloudTrail and related identity logs for activity during that window.
• The attacker used credentials for Qubole’s AWS account to assume customer IAM roles established for cross-account integration.
• Malicious role-assumption requests identified by Wiz included the required External ID and succeeded, showing that this control did not prevent use of the compromised credentials.
• Reported activity involved AWS account 805246085872, IAM user AIDA3W7DIFLYOLTK63SFS, Mullvad VPN-associated addresses, and OVH-hosted IP 57.129.54[.]120.
• Sentra said the campaign affected dozens of Qubole customers; many targeted roles had no legitimate Qubole activity during October but remained enabled.
• Access included resource enumeration and retrieval of secrets or configuration data from S3, databases, EC2, IAM, Secrets Manager, Systems Manager Parameter Store, and Lambda configurations.
• Wiz reported S3 downloads, including instances in which entire buckets were retrieved during individual sessions.
• Credentials tested with TruffleHog included AWS access keys, Microsoft Entra ID service principal credentials, and Okta OAuth client credentials.
• Contractors should assess whether third-party integrations had cross-account access, revoke unused permissions, rotate potentially exposed credentials, and tighten cross-account trust policies.
• No government award, solicitation, or procurement opportunity was identified in the source reporting; the immediate relevance is cloud security and supplier-risk management.