A significant supply chain attack has been uncovered involving the popular big-data platform Qubole, impacting over a dozen organizations. Cybersecurity researchers found that attackers exploited compromised Identity and Access Management (IAM) credentials tied to Qubole's Amazon Web Services (AWS) account. These credentials enabled the attackers to assume IAM roles set up by organizations for Qubole, granting them access to those organizations' AWS environments.
In typical SaaS operations, customers create specific IAM roles to allow vendors like Qubole to access their AWS environments when needed. However, in this case, the compromised credentials allowed the attackers to assume these roles and siphon off data. According to cybersecurity firm Sentra, many of these roles had been left in place long after organizations ceased using Qubole, leaving their data vulnerable.
The attack campaign began on October 14 and continued until October 26, utilizing rented OVH servers and the Mullvad VPN, with no activity originating from Qubole's own network. Attackers used a consistent naming pattern for role session names, such as 'quiam-enum' and 'quiam-scope-full', to systematically enumerate resources, collect secrets, and access data. Following this, they extracted data from S3 buckets without targeting specific information, often downloading entire buckets at once.
Wiz, another cybersecurity firm involved in analyzing the attack, identified an ISO file capable of being remotely booted on victim machines to harvest data, although there is no evidence it was used. The firm noted that the attack appeared opportunistic with no apparent links to state-sponsored activities. Additionally, a separate campaign involving Qubole integrations occurred earlier in October, where customer-owned AWS access keys were tested and used to access environments.
