Qubole - GoKawiil

Attacker hijacked Qubole AWS credentials to breach customer cloud data

Wiz reports that a threat actor compromised IAM credentials for Qubole's AWS account and used them to assume unused, trusted IAM roles in dozens of customer AWS environments between October 14 and 26. The attacker surveyed cloud resources, pulled secrets from AWS Secrets Manager, SSM Parameter Store and Lambda variables, validated keys with TruffleHog, and downloaded data from accessible S3 buckets.

bleepingcomputer.com · 2026-11-10

Stolen Qubole credentials let attacker access dozens of customers' cloud data

Security firm Sentra identified a supply-chain attack in which an attacker obtained credentials belonging to big-data platform Qubole and used the cross-account access that customer companies had granted to Qubole to pull data from more than a dozen organizations. Sentra reported the campaign to Wiz, which investigated alongside Sentra and Mandiant and has since published full research findings; the attacker reportedly moved between compromised accounts in roughly a second each.

sentra.io · 2026-11-09