---
title: "Qubole integration-role abuse campaign"
description: "Wiz observed attackers abusing Qubole integration roles to collect secrets and steal data from customer AWS environments in October 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-13"
canonical_url: "https://www.ally.security/incidents/qubole-integration-role-abuse-campaign-2026"
markdown_url: "https://www.ally.security/incidents/qubole-integration-role-abuse-campaign-2026.md"
stix_url: "https://www.ally.security/incidents/qubole-integration-role-abuse-campaign-2026/stix.json"
---

# Qubole integration-role abuse campaign

Wiz observed attackers abusing Qubole integration roles to collect secrets and steal data from customer AWS environments in October 2026.

Last modified Nov 13, 2026 · 1 source

## Summary

- **Environment:** Customer AWS integration roles trusting Qubole
- **Operational impact:** Cloud secrets and S3 data accessed; disruption not quantified
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Wiz](https://www.wiz.io/), working with [Sentra](https://www.sentra.io/) and [Mandiant](https://cloud.google.com/security/mandiant), observed malicious use of credentials associated with [Qubole](https://www.qubole.com/) to assume customer [AWS](https://aws.amazon.com/) integration roles during October 14–26, 2026. [1](#source-1)

## Impact

The actor harvested cloud secrets and exfiltrated S3 data, sometimes entire buckets. The [Wiz investigation](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild) does not identify victims, an affected-organization total or a stolen-data volume. [1](#source-1)

## Timeline

### October 14, 2026 — First malicious role assumption observed

Existing trust policies accepted the attacker’s requests. [1](#source-1)

### November 9, 2026 — Investigation published

Wiz described the observed cross-customer activity. [1](#source-1)

### November 13, 2026 — Briefing updated

This briefing was last reviewed and updated on November 13, 2026.

## Threat Group & Attack Vector

The attacker used standing trust relationships, including external IDs. Most observed roles otherwise had no legitimate vendor use during October. How the original credentials were compromised remains unknown. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): vendor-associated credentials enabled access through customer integration roles. [1](#source-1)

## Response

Wiz recommended removing unnecessary integration trust, revoking sessions, rotating accessible secrets and reviewing cloud logs. The report does not establish that every victim completed those actions. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/qubole-integration-role-abuse-campaign-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Trusted by Default: Qubole Cross-Account Access Abused in the Wild

research · Wiz · Nov 9, 2026

<https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: First observed malicious role assumption
2. **Occurred At · 100% confidence · current**  
   First observed malicious role assumption: 2026-10-14
3. **Used Attack Technique · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: https://attack.mitre.org/techniques/T1078/
4. **Affected Organization · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: Qubole
5. **Ended At · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: 2026-10-26
6. **Resulted In · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: The actor enumerated cloud resources and harvested credentials from Lambda configuration, Secrets Manager and SSM Parameter Store, then tested discovered credentials.
7. **Began At · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: 2026-10-14
8. **Resulted In · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: Standing customer trust policies accepted the role assumptions, including required external IDs. Most observed roles otherwise had no legitimate vendor use during October.
9. **Resulted In · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: Wiz, working with Sentra and Mandiant, observed malicious use of credentials from an AWS account associated with Qubole to assume customer-created integration roles during October 14–26, 2026.
10. **Resulted In · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: Wiz recommended reviewing integration trust, revoking unnecessary roles and active sessions, rotating accessible secrets, and checking cloud activity logs. These are recommendations, not claims that every victim completed remediation.
11. **Occurred At · 100% confidence · current**  
   Wiz publishes investigation: 2026-11-09
12. **Resulted In · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: Wiz observed data exfiltration from S3 through the assumed integration roles, including entire buckets in some sessions. Victim names, an affected-organization total and a data-volume total were not disclosed.
13. **Resulted In · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: Wiz publishes investigation
14. **Disclosed At · 100% confidence · current**  
   Qubole integration-role abuse across customer AWS environments: 2026-11-09

</details>