A threat actor exploited compromised identity and access management credentials for the Qubole platform to access multiple customer environments. The campaign occurred between October 14 and 26, affecting tens of companies that trusted Qubole's AWS account. Researchers from Wiz and Mandiant found the attacker used the STS AssumeRole API to assume unused roles and exfiltrate data. The intruder retrieved secrets from AWS Secrets Manager and SSM Parameter Store, then downloaded contents from accessible S3 buckets. AWS stated its services were not compromised and advised customers to review cross-account roles and rotate exposed credentials.
Read the full story at bleepingcomputer.com.
