Qubole credentials used to access customer AWS accounts, enumerate resources, retrieve secrets and download S3 files
CSO Online reports cross-account abuse via compromised Qubole credentials resulting in resource enumeration, secrets retrieval and S3 file downloads; immediate remediation advised.
- Urgency
- L4
- 57
- 75
- 30
- 20
- 80
At a glance
A CSO Online report indicates attackers used compromised Qubole credentials to access customer AWS accounts that had established cross-account permissions with Qubole. The attacker activity included enumerating cloud resources, retrieving secrets and configuration data, downloading files from Amazon S3, and testing credentials belonging to affected organizations. Organizations with cross-account trust to Qubole should immediately review access logs, rotate trusted roles and keys, and hunt for follow-on activity.
- CSO Online reports cross-account abuse via compromised Qubole credentials resulting in resource enumeration, secrets retrieval and S3 file downloads; immediate remediation advised.
CHRONOS Wire · November 11 · Alert 15
What happened
Attackers used compromised Qubole credentials to access customer cloud accounts, copy files from S3, and test credentials they found. Any organization that granted Qubole cross-account access should assume those trust relationships may have been abused and investigate.
Why it matters
Cross-account trust abuse can provide attackers privileged access across multiple customer environments; organizations should act quickly to revoke and rotate trusted credentials and hunt for compromise.
CHRONOS Bottom Line
Organizations that granted cross-account trust to Qubole should review CloudTrail and access logs, rotate any keys or roles trusted by Qubole, and hunt for signs of lateral movement or data exfiltration.
Full detail
What changed
A CSO Online report describes that compromised Qubole credentials were used to assume cross-account access into customer AWS accounts and that the access was used to enumerate resources, retrieve secrets and configuration data, download files from S3, and test credentials.
What is genuinely new
CSO Online published an account that compromised Qubole credentials were used to assume cross-account access into customer AWS accounts and that the access was used to enumerate resources, retrieve secrets and configuration data, download files from S3, and test credentials.
Detailed analysis
According to the CSO Online report, attackers used compromised Qubole credentials to assume cross-account roles in customer AWS accounts, then enumerated resources, retrieved secrets and configuration data, downloaded files from S3, and tested credentials discovered during the intrusion. The vector relies on customers having configured cross-account trust with Qubole. Remediation should include revoking or rotating trusted roles and credentials, searching CloudTrail and application logs for unusual role assumptions and data transfers, and rotating any exposed secrets.
U.S. Impact
U.S. Impact assessment pending.