A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it.
Trusted by Default: Qubole Cross-Account Access Abused in the Wild
About this summary. This is a short excerpt from the description that Wiz published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild
Source attribution: headline and facts are from Wiz (wiz.io). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
56 AWS API calls in 141 milliseconds: Inside an AI-run intrusion
One server read 56 EC2 user data scripts in 141 milliseconds. Then it went quiet for 14 days and came back. That gap did more damage than the burst, because fixed…
AI Pentest Tool AntiFox Abused To Steal AWS Credentials
Arctic Wolf saw attackers use the AntiFox pentest platform to hit IIS servers and AWS accounts. Arctic Wolf Labs has published research on attackers using AntiFox, an…
Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple…
VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities
Overview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to…
Before A Stolen Password Becomes An Attack: Identity Protection With Group-IB XDR
Identify compromised Active Directory accounts with Group-IB Threat Intelligence and reset affected passwords from the Group-IB XDR Console before attackers can use them.
How Rapid7 InsightGovCloud Supports BOD 22-01 Compliance
An introduction to CISA’s BOD 22-01Issued nearly four years ago, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive 22-01…