Wiz says an intruder used credentials associated with Qubole’s AWS account to assume customer integration roles between October 14 and 26. Its November 9 investigation describes secret harvesting and S3 data theft. The total victim count remains unspecified.
Many compromised environments retained vendor trust without legitimate integration activity. The attacker supplied valid External IDs.
Defenders should review CloudTrail from October 1 for AssumeRole calls from account 805246085872, especially unexpected non-AWS sources, then follow the session’s subsequent activity. Shared VPN addresses alone are inconclusive.
Wiz recommends rotating accessible secrets and revoking active role sessions. Changing a credential does not end temporary sessions already issued. Removing unused vendor trust is another recommended step.
Investigators also need S3 data events or server access logs to identify object reads; management events do not record those reads.
