Trusted by Default: Qubole Cross-Account Access Abused in the Wild

A threat actor abused cross-account IAM roles trusted to Qubole's AWS account (805246085872) to gain unauthorized access to multiple customer environments between October 14 and October 26, 2026. The actor used stolen IAM credentials from Qubole-associated accounts to assume roles in victim AWS environments, primarily originating from malicious IP addresses linked to Mullvad VPN and an OVH VPS. Once inside, the actor performed broad enumeration, harvested secrets from Lambda, Secrets Manager, and SSM Parameter Store, validated credentials using TruffleHog, and exfiltrated data from S3 buckets. A suspicious ISO file named sso_agent.iso was also identified on the attacker's infrastructure, indicating potential for further compromise.

AI-extracted · verify before operational use