Attackers backdoor trusted AWS integrations to steal secrets

Attackers used compromised credentials tied to Qubole’s AWS account to enter customer cloud environments through trusted cross-account roles. They stole secrets and data, highlighting how third-party integrations can expose customers when access permissions remain active.

Wiz researchers traced activity from 14 October, with a second IAM user involved from 18 October. The attackers probed AWS services, accessed credentials stored in Lambda, Secrets Manager and SSM Parameter Store, and took data from S3 buckets; the number of affected organisations is undisclosed. Wiz also found a separate campaign earlier in October involving Qubole integration keys, but could not confirm whether it was connected. It advises customers to rotate credentials, review CloudTrail records from 1 October and revoke active sessions.