Hackers exploit trusted AWS access to breach multiple cloud environments

A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.

The campaign ran between October 14 and 26, and affected tens of companies whose AWS environments had IAM roles configured to trust an AWS account associated with Qubole.

Qubole is an enterprise cloud data processing and analytics platform that helps companies manage large datasets and run machine learning workloads. It also offers AWS integration to allow computing resource management.

Companies can grant third-party providers such as Qubole access to their AWS resources by creating cross-account IAM roles. Trust policies determine which external AWS accounts can take these roles, and permissions are set to define the resources and actions allowed.