Attackers backdoor trusted AWS integrations to steal secrets

Unknown attackers used compromised identity and access management (IAM) credentials associated with Qubole's AWS account to access customer AWS environments, stealing secrets and other sensitive data from S3 buckets.

Qubole is a cloud data processing platform that uses cross-account IAM roles to manage compute and access storage in customers' AWS environments without requiring customers to provide long-lived AWS access keys. The supply-chain attack abused this third-party, cross-account trust relationship.

Google’s cloud-security shop Wiz declined to tell us how many organizations were affected, but called it a “broad, opportunistic supply chain campaign” that hit “multiple” customer environments.

“Because many organizations left trust policies active even after deprecating the platform, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and siphon data,” the researchers told The Register in an emailed response to questions.

Neither AWS nor Qubole responded to The Register 's inquiries.

Wiz, working with Google's Mandiant incident responders after AI data security company Sentra flagged …