- A threat actor used Qubole-associated IAM credentials between Oct 14 and Oct 26, 2026.
- The actor assumed customer roles that trusted Qubole’s AWS account and accessed resources, secrets and S3 data.
- Wiz has not identified any deployment of the bootable ISO it found and cannot confirm whether or how it was used.
A threat actor used IAM credentials from an AWS account associated with Qubole to access multiple customer environments between Oct 14 and Oct 26, 2026, Wiz said in a report published Nov 9.
The actor assumed customer IAM roles that trusted Qubole’s account, then enumerated resources, collected configuration and secrets, accessed S3 data and validated additional credentials. Wiz said the credentials tested belonged to the affected organizations, not to the vendor.
Qubole is a data lake platform owned by Idera that operates within customers’ AWS accounts, The Hacker News said. Sentra identified suspicious activity across several customer environments and shared it with Wiz, prompting the investigation.
On this page
The actor used successful AssumeRole requests and named sessions quiam-
Wiz said the first observed activity occurred on Oct 14, when a Mullvad VPN address called AssumeRole against customer integration roles. From Oct 15, most of the activity came from an OVH-hosted address, and on Oct 18 the actor began using a second IAM user from the same account that also carried legitimate Qubole platform traffic from AWS infrastructure.
Every AssumeRole request attributed to the actor included an External ID and succeeded. The role-session names followed the prefix quiam-, including quiam-enum and quiam-scope-full.
Lambda, Secrets Manager and SSM data were queried
The actor listed Lambda functions and called GetFunctionConfiguration on each, which returns function environment variables. Wiz also identified calls to list secrets and retrieve secret values from Secrets Manager, along with requests to describe and get parameters from SSM Parameter Store.
Wiz said the actor used TruffleHog to test credentials found in victim environments. The credentials belonged to the affected organizations, not to the vendor.
Wiz found a bootable ISO it believes was designed for remote booting
Wiz identified an ISO file named sso_agent.iso hosted on the actor’s OVH address. It said the bootable Linux image was believed to be designed for remote booting on a victim machine.
Wiz also identified separate activity from Oct 8 to Oct 11 in which an actor used customer-owned AWS access keys believed to have been created for Qubole integrations.
Wiz said organizations integrated with Qubole should review CloudTrail from Oct 1, 2026 onward in every account that holds an integration role. It also said the source IP condition alone would have blocked every role assumption it observed.
The Hacker News reported that how the attacker obtained the Qubole-associated credentials has not been disclosed. Wiz has not identified any deployment of the ISO file and cannot confirm whether or how it was used.
What to do now
- Review CloudTrail from Oct 1, 2026 onward in every account that holds an integration role.
- Rotate every secret, parameter and Lambda environment variable the assumed integration role could read, and revoke active sessions for the role.
- Where the vendor supports it, replace the account:root principal with the specific vendor IAM principal and add an aws:SourceIp or aws:SourceVpce condition limiting role assumption to the vendor’s documented network ranges.
FAQ
What happened to Qubole AWS integrations?
A threat actor used IAM credentials from an AWS account associated with Qubole to assume customer roles and access multiple customer environments between Oct 14 and Oct 26, 2026.
What data did the Qubole-linked actor access?
Wiz said the actor enumerated resources, collected configuration and secrets, accessed S3 data, and validated additional credentials. It also queried Lambda environment variables, Secrets Manager and SSM Parameter Store.
Was the Qubole AWS campaign confirmed to deploy the ISO?
No. Wiz identified an ISO it believed was designed for remote booting, but it has not identified any deployment and cannot confirm whether or how it was used.
How did the actor access customer AWS roles?
The actor used Qubole-associated IAM credentials to assume customer IAM roles that trusted Qubole’s account. Every attributed AssumeRole request included an External ID and succeeded.
What should Qubole-integrated organizations review?
Wiz said to review CloudTrail from Oct 1, 2026 onward in every account holding an integration role, rotate every secret and parameter the role could read, revoke active sessions, and delete unused integration roles or remove the vendor account from their trust policies.
What was the earlier Qubole-related activity?
Wiz identified separate activity from Oct 8 to Oct 11 involving customer-owned AWS access keys believed to have been created for Qubole integrations.
Sources
How we checked this story
| Claim | Source | Status |
|---|---|---|
| Wiz observed a threat actor using IAM credentials from an AWS account associated with Qubole between 14 and 26 October 2026. | Wiz | Confirmed |
| Wiz said the actor assumed customer IAM roles that trusted Qubole’s account and then enumerated resources, collected secrets, accessed S3 data, and validated credentials. | Wiz | Confirmed |
| Sentra identified suspicious activity across several customer environments and shared it with Wiz, prompting the investigation. | Wiz | Confirmed |
| Wiz said the first observed activity occurred on 14 October, when a Mullvad VPN address called AssumeRole against customer integration roles. | Wiz | Confirmed |
| From 15 October, most activity came from an OVH-hosted address, and on 18 October the actor began using a second IAM user also carrying legitimate Qubole traffic. | Wiz | Confirmed |
| Every AssumeRole request attributed to the threat actor included an External ID and succeeded. | Wiz | Confirmed |
| The actor used role-session names beginning with quiam-, including quiam-enum and quiam-scope-full. | Wiz | Confirmed |
| The actor listed Lambda functions and retrieved their environment variables, secrets from Secrets Manager, and parameters from SSM Parameter Store. | Wiz | Confirmed |
| Wiz identified an ISO file hosted on the actor’s OVH address that it believes was designed to be remotely booted on a victim machine. | Wiz | Confirmed |
| Wiz has not identified any deployment of the ISO and cannot confirm whether or how it was used. | Wiz | Confirmed |
| Wiz also identified separate activity from 8 to 11 October in which an actor used customer-owned AWS keys believed to have been created for Qubole integrations. | Wiz | Confirmed |
| Wiz recommends deleting unused integration roles or removing the vendor account from their trust policies. | Wiz | Confirmed |
| Wiz said a source IP condition alone would have blocked every role assumption it observed. | Wiz | Confirmed |
| The Hacker News said qubole is a data lake platform owned by Idera that operates within customers’ AWS accounts. | The Hacker News | Attributed |
| wiz.io published its report on Nov 9, 2026. | wiz.io | Confirmed |
Could not verify
- Whether the attacker’s credentials have been disabled is not established.
- Whether the activity has stopped is not established.
- How many Qubole customers or AWS accounts were affected is not established.
- Whether the ISO was deployed or used is not established.
- Whether the separate 8–11 October access-key activity is linked to the role-assumption campaign is not established.
Related stories
AI Supply ChainCorelight: MCP server setups let dependencies change unnoticed
Vulns & PatchesCitrix discloses critical NetScaler zero-days after exploitation reports
Data LeaksArara email service breach exposed more than 1 million Osaka addresses