Wiz reports that an attacker used credentials for an AWS account Qubole’s platform uses to reach customers, then accessed multiple customers’ AWS accounts and stole stored secrets and data between October 14 and 26.
Customers configure an IAM role and trust policy for that access.
The source of the credentials has not been disclosed.
Qubole, owned by Idera, provides a data management platform that is linked to its customers’ accounts. To do this, customers create special digital access profiles that give Qubole the right to manage their resources. According to security firm Wiz, the attacker used login details belonging to Qubole itself to gain access, specifically through account 805246085872, although it is not yet known exactly how he obtained them.
How the perpetrator moved through the accounts
Another security firm, Sentra, spotted the activity in several customer environments and alerted researchers. When the attacker accessed the accounts, he would read settings from programs, collect access keys, and test them using special tools, such as digital keys for various services. He would then copy bulk data from victims’ storage, often downloading entire folders in a single session.
The attacker used web addresses hosted on OVH and addresses from location-aware services. Prior to this incident, another activity was separately detected between October 8 and 11, where unknown individuals directly used customer access keys configured for Qubole.
What does the data show so far?
Researchers have published instructions for reviewing activity logs from October 1 onwards for those with accounts with the relevant Qubole profile. At the time of the review, Qubole and Idera had not posted any announcements on their websites about the attack.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Spy group launches new attacks with unknown program
↗
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)