A unified narrative from security investigators reveals that attackers prioritized services acting as credential repositories to facilitate lateral movement across multiple AWS accounts. This strategic focus became painfully evident during a multi-week exploitation campaign targeting the Qubole data processing platform between October 14 and October 26, 2026. Unlike many high-profile incidents that rely on sophisticated zero-day vulnerabilities or unpatched software, this breach exploited a more insidious flaw: the persistence of trusted identity and access management (IAM) configurations that survived long after their business utility had expired. By targeting these “zombie” IAM roles, malicious actors were able to walk through the front door of numerous corporate AWS environments, leveraging the inherent trust established between the third-party service and the client. The incident serves as a stark reminder that in the modern cloud landscape, identity is the most critical perimeter, and any failure to govern these permissions effectively creates an enduring and invisible backdoor for sophisticated adversaries.
The Mechanics of Compromised Identity Trust
The breach centered on the exploitation of cross-account trust relationships, a fundamental feature of the AWS ecosystem that allows third-party vendors like Qubole to perform tasks within a customer’s cloud environment. Investigators discovered that attackers specifically sought out IAM roles where the trust relationship remained active despite the customer no longer using the Qubole service. These stale roles acted as persistent entry points, as the AWS Security Token Service continued to honor role-assumption requests because the underlying trust policy had never been deleted from the customer’s account. This method of entry is particularly dangerous because it does not trigger standard intrusion detection systems designed to look for exploit signatures or brute-force attempts. Instead, the attackers used legitimate AWS API calls that appeared to be authorized administrative traffic, allowing them to remain undetected while they mapped out the internal architecture of the compromised environments without immediate suspicion.
Furthermore, the investigation highlighted a significant limitation in the use of External IDs, which are traditionally used to prevent the “confused deputy” problem in cross-account access. While AWS mandates the use of these IDs to ensure that a third party is accessing the correct customer account, the security campaign proved that if these identifiers are stored insecurely or if the vendor’s own environment is compromised, they offer virtually no protection. The attackers possessed the necessary External IDs to successfully complete the AssumeRole handshake, effectively turning a security feature into a key for their own use. This situation underscores a broader systemic issue where organizations trust the technical configurations of their vendors without implementing a rigorous lifecycle management process for those permissions. When a service is decommissioned, the business relationship might end on a dashboard, but the technical door remains wide open until the specific IAM roles are manually purged from the infrastructure, leaving a legacy of risk that can be exploited years later.
Reconnaissance Tactics: Automated Secret Discovery
Once the adversaries successfully assumed a Qubole-related role, they transitioned into a methodical reconnaissance phase designed to maximize the impact of their access. Rather than moving directly to data theft, they focused on expanding their footprint by investigating high-value targets like the AWS Systems Manager Parameter Store and Lambda environment variables. By using cloud-native discovery techniques, they searched for additional secrets, such as API keys for identity providers like Okta or Microsoft Entra ID. This lateral movement strategy allowed them to pivot from a single compromised IAM role into broader sections of the organization’s digital infrastructure, potentially gaining access to internal corporate applications or other linked AWS accounts. The attackers demonstrated a deep understanding of cloud architecture, prioritizing services that function as credential repositories. This approach ensured that even if the initial Qubole role was eventually discovered and revoked, they might have already secured alternative access paths through stolen long-term credentials or secondary identities.
The technical execution of this campaign was further bolstered by the use of legitimate security tooling, most notably TruffleHog, which was utilized to automate the discovery of sensitive information within the victim’s environment. By scanning configurations and code for hardcoded secrets, the attackers were able to quickly identify live credentials that could be used for further exploitation. This blending of adversarial intent with professional security tools makes detection significantly more difficult for security operations centers, as the activity often mirrors that of a standard internal audit or a developer troubleshooting a cloud configuration. To further obscure their origins, the attackers routed their traffic through Mullvad VPN and OVH hosting infrastructure, attempting to hide their true location behind common commercial network ranges. This combination of cloud-specific expertise and traditional operational security measures allowed the threat actors to conduct large-scale data exfiltration, in some cases downloading the entire contents of S3 buckets in a single session rather than targeting specific files.
Strategic Defensive Hardening: Incident Response
Identifying these breaches required security teams to move beyond basic perimeter monitoring and delve into the nuances of CloudTrail log analysis. The primary indicator of compromise was not an external attack signature, but rather anomalous “AssumeRole” events originating from unexpected network sources. While legitimate Qubole operations typically stem from predictable AWS-owned IP ranges, the malicious requests were identified by their association with VPN providers and foreign hosting services. Security researchers noted that tracking these anomalies is often difficult because management events alone do not provide a complete picture of data theft. Without enabling S3 Data Events or Server Access Logs, many organizations remained unaware that their sensitive data was being harvested, as the initial role assumption appeared legitimate. This gap in visibility highlights the necessity of comprehensive logging that tracks not just who accessed the environment, but what specific actions they took and what data objects they interacted with during the duration of the temporary security session.
Ultimately, the remediation strategies deployed by affected organizations highlighted that rotating secrets was merely the first step in a much larger recovery process. Because AWS issues temporary security tokens that remain valid for several hours, security teams discovered that they had to manually revoke active IAM sessions to fully disconnect the malicious actors. This incident prompted a shift toward automated lifecycle management for third-party permissions, where identity-governance tools were integrated to flag any cross-account roles that had not been utilized within a thirty-day window. Organizations found success in implementing granular permission boundaries, ensuring that even if a role was assumed, the attacker’s ability to list S3 buckets or access the Secrets Manager was strictly curtailed. By establishing these technical guardrails and ensuring that technical trust was severed as decisively as the business contract, cloud architects moved closer to a zero-trust model where no identity is allowed to remain stale or over-privileged.
