GoKawiilAttacker hijacked Qubole AWS credentials to breach customer cloud data
Wiz reports that a threat actor compromised IAM credentials for Qubole's AWS account and used them to assume unused, trusted IAM roles in dozens of customer AWS environments between October 14 and 26. The attacker surveyed cloud resources, pulled secrets from AWS Secrets Manager, SSM Parameter Store and Lambda variables, validated keys with TruffleHog, and downloaded data from accessible S3 buckets.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how cross-account trust relationships between companies and third-party cloud service providers can become a single point of failure, letting one compromised vendor account cascade into breaches across many customer environments. It suggests organizations may need to audit dormant or overly permissive IAM roles tied to vendors, since unused trust configurations can still be exploited long after being set up.
- Compromised Qubole IAM credentials let attackers assume trusted roles in multiple customer AWS accounts.
- The attack, running October 14–26, involved secret harvesting, credential validation via TruffleHog, and S3 data exfiltration.
- Discovery relied on joint investigation by Wiz, Sentra, and Mandiant, underscoring supply-chain risk in cloud trust relationships.
YubiKey 5 Series Security Key — Incidents like this stem from exposed or over-trusted credentials, and hardware security keys make it far harder for attackers to hijack privileged IAM or admin accounts even if passwords leak. YubiKeys are widely supported for AWS root/IAM console MFA and are a practical step for any team managing cloud trust relationships. A small investment that meaningfully hardens access to critical cloud infrastructure.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-10
Published there as: “Hackers exploit trusted AWS access to breach multiple cloud environments”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.