Ethical Hacking News
A recent supply-chain attack has targeted trusted AWS integrations, leaving customers vulnerable to data theft. The attackers used compromised identity and access management (IAM) credentials associated with a cloud data processing platform to access customer AWS environments. The attackers were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. Experts are warning that the use of trusted third-party services can sometimes be exploited by malicious actors, and customers are advised to review CloudTrail from October 1 onward, looking for AssumeRole events where userIdentity.accountId matches Qubole's AWS account ID, 805246085872, particularly those originating from non-AWS IP addresses.
Trusted AWS integrations were targeted in a supply-chain attack, leaving customers vulnerable to data theft. The attackers used compromised IAM credentials to access customer AWS environments, enumerate cloud resources, harvest secrets, and siphon data. The attackers also used a second IAM user to access customers' AWS environments and steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store. The attackers used tools like TruffleHog to test AWS credentials, discover Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, often downloading entire buckets. Experts warn that the use of trusted third-party services can be exploited by malicious actors, highlighting the need for customers to review CloudTrail logs.
In a recent development that highlights the ever-evolving threat landscape of cyber attacks, researchers have uncovered a significant supply-chain attack that targets trusted AWS integrations. The attack, which was carried out by a group of attackers, has left numerous customers vulnerable to data theft, with the attackers using compromised identity and access management (IAM) credentials associated with a cloud data processing platform to access customer AWS environments. The incident has sparked concerns about the security of supply chains in the cloud, with experts warning that the use of trusted third-party services can sometimes be exploited by malicious actors.
The attack, which was first reported by the cybersecurity firm Wiz, involved the use of compromised IAM credentials to access customer AWS environments. The attackers, who were identified as using a third-party cloud data processing platform, were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers also used a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers also used a tool called TruffleHog to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The incident has sparked concerns about the security of supply chains in the cloud, with experts warning that the use of trusted third-party services can sometimes be exploited by malicious actors. The attackers were able to abuse the integration roles, enumerate cloud resources, harvest secrets, and siphon data, highlighting the need for customers to review CloudTrail from October 1 onward, looking for AssumeRole events where userIdentity.accountId matches Qubole's AWS account ID, 805246085872, particularly those originating from non-AWS IP addresses.
The attackers also used a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store. The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials.
The incident has sparked concerns about the security of supply chains in the cloud, with experts warning that the use of trusted third-party services can sometimes be exploited by malicious actors. The attackers were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data, highlighting the need for customers to review CloudTrail from October 1 onward, looking for AssumeRole events where userIdentity.accountId matches Qubole's AWS account ID, 805246085872, particularly those originating from non-AWS IP addresses.
The attackers were also able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data. The attackers used a tool called TruffleHog to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
The attackers were able to use the compromised IAM credentials to access customer AWS environments, and were able to assume integration roles, enumerate cloud resources, harvest secrets, and siphon data. The attackers were also able to use a second IAM user to access customers' AWS environments, and were able to steal credentials, keys, and other secrets stored across Lambda, Secrets Manager, and SSM Parameter Store.
The attackers were able to test AWS credentials belonging to victim organizations, discover their Microsoft Entra ID secrets, and request OAuth tokens using Okta client credentials. The attackers were able to steal data from customers' S3 storage, although it appears that they were largely opportunistic attackers, in some cases downloading entire buckets, as opposed to state-sponsored spies looking for specific data.
Related Information:
https://www.ethicalhackingnews.com/articles/Widespread-Supply-Chain-Attacks-Target-Trusted-AWS-Integrations-Leaving-Customers-Vulnerable-to-Data-Theft-ehn.shtml
https://www.theregister.com/security/2026/11/09/attackers-backdoor-trusted-aws-integrations-to-steal-secrets/5308553
Published: Mon Nov 9 17:31:25 2026 by llama3.2 3B Q4_K_M
