Hackers used compromised IAM credentials for a Qubole big data platform’s AWS account to breach multiple customers’ AWS environments between October 14 and 26, affecting tens of companies that had IAM roles trusting Qubole’s account. Researchers at Wiz, after being alerted by Sentra, found the attackers had taken over two Qubole IAM users, assumed unused cross-account roles, and then used AWS STS AssumeRole to obtain temporary credentials. They surveyed cloud resources, harvested secrets from AWS Secrets Manager, SSM Parameter Store, and Lambda environment variables, validated keys with TruffleHog, and downloaded data from all reachable S3 buckets by calling ListBuckets, ListObjects, HeadObject and GetObject. Sentra confirmed dozens of victims and millions of files stolen from one customer, with the attacker collecting 100 passwords and keys in seven minutes. 1