{
  "type": "bundle",
  "id": "bundle--946d57c2-09a3-5fdc-8790-261c40213d3f",
  "objects": [
    {
      "type": "campaign",
      "spec_version": "2.1",
      "id": "campaign--fb41cf47-e89f-52a5-8e48-3129cc8e2452",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "cam:138d92d0-bd16-4c0a-b185-97342aa05475",
      "name": "Qubole integration-role abuse across customer AWS environments"
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--3e2b182f-da62-566f-8ee7-14271ed11561",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "org:5ce95294-a62e-4bfe-af22-c953ae921c72",
      "name": "Qubole",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--efdac46d-dc83-51ba-8d6c-567c224b4c48",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "brh:2d871558-1537-402f-b034-486ee18d93da",
      "name": "Qubole integration-role abuse campaign"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--09157323-ab9f-51ac-8653-bc42440d815c",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:f7a9a9a5-0c61-4ac2-9489-f635a411f601",
      "relationship_type": "resulted-in",
      "source_ref": "campaign--fb41cf47-e89f-52a5-8e48-3129cc8e2452",
      "target_ref": "x-ally-event--cd6d8a2d-14bb-51ba-8f9a-c6bcd65e8d41",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:aed346dc-eaf0-484d-ba53-5fa9f4e90a86",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--4a04668a-ac1c-56d9-8aad-7561eec10606",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:602e0106-d46e-47ac-86e9-855ab3d5a66d",
      "relationship_type": "affected-organization",
      "source_ref": "campaign--fb41cf47-e89f-52a5-8e48-3129cc8e2452",
      "target_ref": "identity--3e2b182f-da62-566f-8ee7-14271ed11561",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:b8a56c9f-8248-4642-ba7a-3ebf90240f32",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6ed95e20-fe88-522f-8586-42beaf353ef1",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:1895c6fb-a6e3-4c9c-9323-e09614f9493b",
      "relationship_type": "resulted-in",
      "source_ref": "campaign--fb41cf47-e89f-52a5-8e48-3129cc8e2452",
      "target_ref": "x-ally-event--36024aaf-badf-53fc-828e-ae4471a7d3dc",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:db5ce0e0-82ad-4f4c-b5ac-6ae5dfb92b20",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--0899eeab-c50f-5f98-89d2-1f4f7e8c1409",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:262e9549-f501-4391-8c03-4fa9ee621622",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1078/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--13504c52-d04d-5c2f-841e-3a002af40bd4",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:6750aaa0-04d3-4c84-b1b4-21c4952f1392",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:e761bac0-fd5f-4d69-8b78-991fbe3dcc60",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The actor enumerated cloud resources and harvested credentials from Lambda configuration, Secrets Manager and SSM Parameter Store, then tested discovered credentials."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--6749557e-6965-57ba-83fc-1fbd6bc27c18",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:7236ee38-743a-47bb-964f-b35671f262ea",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:db8ccd15-f0b3-4795-9da8-c75287a4db8e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--88d58478-3525-51d2-8ea8-162c3fe76c57",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:2567f22e-798b-4dad-8be3-eb40bec0e759",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:bad26e31-79a3-48ff-a2e4-ccb720542c2b",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-14"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--97ba8331-962b-5763-8baa-f7caf2180939",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:bb204440-ac92-4713-ad36-dada569efe14",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:6bf6b31d-1708-46a5-8024-fde1d2558abc",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-09"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9ddf29af-65ff-5b0b-879e-9f52e5d71aae",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:666f9795-8911-4b18-bfca-ec980252e8f0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:c06ea205-1e33-4674-84c8-29663d28ff77",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-26"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9eddbdee-dbb5-5c53-841a-4e7ec4b2174b",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:fec92079-e6cb-4289-b3cb-c7475ccd95c7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:8c205c89-f3c3-46de-8469-8447476f8996",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-09"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b10bf6a9-f2f0-560a-82f1-89dc9d218816",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:dfad6a8f-74e1-4cf6-a523-4d2a7626d8c8",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:afe93cc0-7157-418e-b60d-7c4f627e0a2a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Wiz observed data exfiltration from S3 through the assumed integration roles, including entire buckets in some sessions. Victim names, an affected-organization total and a data-volume total were not disclosed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b346cedd-fb05-58e6-8ab8-2c24c4024366",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:a0737bac-300a-46b2-b947-73f3145a8614",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:2367d329-f8c4-48ca-9491-1e4088f5af90",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Wiz, working with Sentra and Mandiant, observed malicious use of credentials from an AWS account associated with Qubole to assume customer-created integration roles during October 14–26, 2026."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c0f99f7a-999f-5afa-85e8-45766b2f7674",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:7d441521-21db-4ffa-92f2-4df4d4be1253",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:8572f79f-624d-4cc4-890e-dd5c8834fde9",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Standing customer trust policies accepted the role assumptions, including required external IDs. Most observed roles otherwise had no legitimate vendor use during October."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d18d4606-4497-5c55-8f12-ab0a504efcd1",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "clm:a0faf19d-a2e8-4738-befa-78a238f3e6d4",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Wiz",
          "url": "https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild",
          "external_id": "cit:a4f50b39-4654-46e2-a3a6-0ac3a1c9ff68",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7d06ad70a4e109c6057a4ba190b3fc6ef7d647742bdc7237218b3a6d9adb8c35"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Wiz recommended reviewing integration trust, revoking unnecessary roles and active sessions, rotating accessible secrets, and checking cloud activity logs. These are recommendations, not claims that every victim completed remediation."
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--36024aaf-badf-53fc-828e-ae4471a7d3dc",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "evt:444a96dc-317a-448e-9767-7f0402a61520",
      "name": "First observed malicious role assumption"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--cd6d8a2d-14bb-51ba-8f9a-c6bcd65e8d41",
      "created": "2026-11-13T14:14:35.229358+00:00",
      "modified": "2026-11-13T14:14:35.229358+00:00",
      "x_ally_original_id": "evt:fbe7235d-7fc3-4b42-94e9-0aae27ced64d",
      "name": "Wiz publishes investigation"
    }
  ]
}