Incident BriefingsQubole integration-role abuse campaign

Qubole integration-role abuse campaign

Wiz observed attackers abusing Qubole integration roles to collect secrets and steal data from customer AWS environments in October 2026.

Last modified

Summary

  • Environment: Customer AWS integration roles trusting Qubole
  • Operational impact: Cloud secrets and S3 data accessed; disruption not quantified
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 13, 2026; updated as evidence emerges.

What happened

Wiz, working with Sentra and Mandiant, observed malicious use of credentials associated with Qubole to assume customer AWS integration roles during October 14–26, 2026. [1]

Impact

The actor harvested cloud secrets and exfiltrated S3 data, sometimes entire buckets. The Wiz investigation does not identify victims, an affected-organization total or a stolen-data volume. [1]

Timeline

  1. First malicious role assumption observed

    Existing trust policies accepted the attacker’s requests.

    [1]

  2. Investigation published

    Wiz described the observed cross-customer activity.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on November 13, 2026.

Threat Group & Attack Vector

The attacker used standing trust relationships, including external IDs. Most observed roles otherwise had no legitimate vendor use during October. How the original credentials were compromised remains unknown. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

Response

Wiz recommended removing unnecessary integration trust, revoking sessions, rotating accessible secrets and reviewing cloud logs. The report does not establish that every victim completed those actions. [1]