--- title: Attackers backdoor trusted AWS integrations to steal secrets description: Attackers compromised IAM credentials tied to Qubole's AWS account and abused cross-account trust roles to steal secrets from customer AWS environments. Wiz... canonical: https://daily.dev/posts/attackers-backdoor-trusted-aws-integrations-to-steal-secrets-wqr41djwr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Attackers backdoor trusted AWS integrations to steal secrets | daily.dev og:description: Attackers compromised IAM credentials tied to Qubole's AWS account and abused cross-account trust roles to steal secrets from customer AWS environments. Wiz... og:url: https://daily.dev/posts/attackers-backdoor-trusted-aws-integrations-to-steal-secrets-wqr41djwr og:image: https://api.daily.dev/og/posts/wQR41djwr.png og:image:alt: Attackers backdoor trusted AWS integrations to steal secrets og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Attackers backdoor trusted AWS integrations to steal secrets **[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments ## Summary Attackers compromised IAM credentials tied to Qubole's AWS account and abused cross-account trust roles to steal secrets from customer AWS environments. Wiz researchers, working with Mandiant after Sentra flagged suspicious activity, traced the activity to October 14, when the stolen credentials called sts:AssumeRole to obtain temporary access to customer-managed integration roles. Attackers harvested secrets from Lambda, Secrets Manager and SSM Parameter Store, used TruffleHog to test credentials, and used Okta client credentials to request OAuth tokens and discover Microsoft Entra ID secrets. In some cases entire S3 buckets were downloaded. Wiz calls it a broad, opportunistic campaign and recommends rotating credentials and reviewing CloudTrail logs from October 1 onward for AssumeRole events from Qubole's account ID 805246085872. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What AWS account ID is behind the Qubole cross-account IAM attack? The malicious AssumeRole calls originated from Qubole's AWS account 805246085872, using IAM user ID AIDA3W7DIFLYOLTK63SFS and later a second IAM user starting October 18. Organizations that integrated with Qubole should search CloudTrail logs from October 1 onward for AssumeRole events matching this account ID, especially from non-AWS IP addresses. _Teams auditing cross-account trust relationships can track incident details like this on daily.dev._ ### What should I check in CloudTrail after a third-party AWS integration is compromised? Review CloudTrail from October 1 onward for AssumeRole events where userIdentity.accountId matches the compromised vendor's AWS account, particularly sessions from non-AWS IP addresses. For every matching role session, review subsequent activity against Secrets Manager, SSM Parameter Store, Lambda and S3, then rotate every secret, parameter and Lambda environment variable the role could read and revoke active sessions. _Anyone hardening IAM after a supply-chain scare can follow incident response writeups like this on daily.dev._ ### How did attackers use TruffleHog in the Qubole AWS supply-chain attack? Attackers used TruffleHog to test stolen AWS credentials belonging to victim organizations, then used what they found to discover Microsoft Entra ID secrets and request OAuth tokens via Okta client credentials also uncovered inside the compromised AWS environments. This let them pivot beyond AWS into Entra ID and Okta-protected resources. _Security teams tracking how stolen secrets chain into other identity providers can follow cases like this on daily.dev._ ## Similar posts on daily.dev - [Rapid7 Labs: Investigating Persistence Mechanisms in AWS](https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [Crypto crooks co-opt stolen AWS creds to mine coins](https://daily.dev/posts/crypto-crooks-co-opt-stolen-aws-creds-to-mine-coins-1jnwvi7wk) · The Register · 1 upvotes · 0 comments - [How a Single Overprivileged Service Turned the LexisNexis Breach Into a Keys-to-the-Kingdom Moment](https://daily.dev/posts/how-a-single-overprivileged-service-turned-the-lexisnexis-breach-into-a-keys-to-the-kingdom-moment-lazovvtmj) · Security Boulevard · 0 upvotes · 0 comments - [Compromised IAM Credentials Power a Large AWS Crypto Mining Campaign](https://daily.dev/posts/compromised-iam-credentials-power-a-large-aws-crypto-mining-campaign-84goyuz0s) · The Hacker News · 0 upvotes · 0 comments - [From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach](https://daily.dev/posts/from-ci-cd-to-cloud-data-how-shai-hulud-persistence-leads-to-redshift-breach-jmqfu4sid) · FortiGuard Threat Research · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#aws](https://daily.dev/tags/aws), [#iam](https://daily.dev/tags/iam), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/attackers-backdoor-trusted-aws-integrations-to-steal-secrets-wqr41djwr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Attackers backdoor trusted AWS integrations to steal secrets","url":"https://daily.dev/posts/attackers-backdoor-trusted-aws-integrations-to-steal-secrets-wqr41djwr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/attackers-backdoor-trusted-aws-integrations-to-steal-secrets-wqr41djwr"},"datePublished":"2026-11-09T20:03:30.841Z","dateModified":"2026-11-10T19:42:08.059Z","description":"Attackers compromised IAM credentials tied to Qubole's AWS account and abused cross-account trust roles to steal secrets from customer AWS environments. Wiz...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/27664575ad66300b61799b409c035784?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/27664575ad66300b61799b409c035784?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/attackers-backdoor-trusted-aws-integrations-to-steal-secrets-wqr41djwr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,aws,iam,secrets-management","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Attackers backdoor trusted AWS integrations to steal secrets"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/attackers-backdoor-trusted-aws-integrations-to-steal-secrets-wqr41djwr#faq","mainEntity":[{"@type":"Question","name":"What AWS account ID is behind the Qubole cross-account IAM attack?","acceptedAnswer":{"@type":"Answer","text":"The malicious AssumeRole calls originated from Qubole's AWS account 805246085872, using IAM user ID AIDA3W7DIFLYOLTK63SFS and later a second IAM user starting October 18. Organizations that integrated with Qubole should search CloudTrail logs from October 1 onward for AssumeRole events matching this account ID, especially from non-AWS IP addresses. Teams auditing cross-account trust relationships can track incident details like this on daily.dev."}},{"@type":"Question","name":"What should I check in CloudTrail after a third-party AWS integration is compromised?","acceptedAnswer":{"@type":"Answer","text":"Review CloudTrail from October 1 onward for AssumeRole events where userIdentity.accountId matches the compromised vendor's AWS account, particularly sessions from non-AWS IP addresses. For every matching role session, review subsequent activity against Secrets Manager, SSM Parameter Store, Lambda and S3, then rotate every secret, parameter and Lambda environment variable the role could read and revoke active sessions. Anyone hardening IAM after a supply-chain scare can follow incident response writeups like this on daily.dev."}},{"@type":"Question","name":"How did attackers use TruffleHog in the Qubole AWS supply-chain attack?","acceptedAnswer":{"@type":"Answer","text":"Attackers used TruffleHog to test stolen AWS credentials belonging to victim organizations, then used what they found to discover Microsoft Entra ID secrets and request OAuth tokens via Okta client credentials also uncovered inside the compromised AWS environments. This let them pivot beyond AWS into Entra ID and Okta-protected resources. Security teams tracking how stolen secrets chain into other identity providers can follow cases like this on daily.dev."}}]} ```