Unknown attackers used compromised identity and access management (IAM) credentials associated with Qubole’s AWS account to access customer AWS environments, stealing secrets and other sensitive data from S3 buckets. Qubole is a cloud data processing platform that uses cross-account IAM roles to manage compute and access storage in customers’ AWS environments without requiring customers to provide long-lived AWS access keys. The supply-chain attack abused this third-party, cross-account trust relationship. Google’s cloud-security shop Wiz declined to tell us how many organizations were affected, but called it a “broad, opportunistic supply chain campaign” that hit “multiple” customer environments. “Because many organizations left trust policies active even after deprecating the platform, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and siphon data,” the researchers told The Register in an emailed response to questions. Neither AWS nor Qubole responded to The Register ‘s inquiries. Wiz, working with Google’s Mandiant incident responders after AI data security company Sentra flagged suspicious activity, traced the malicious activity back to October 14, when credentials associated with Qubole’s AWS account were used to call the sts:AssumeRole API to obtain temporary credentials for customer-managed integration roles. The calls originated from Qubole AWS account 805246085872 , and used IAM user ID AIDA3W7DIFLYOLTK63SFS , Wiz analysts Zack Morrow, Sean Johnstone, and Benjamin Read said in a Monday blog about the supply chain attack. “Across the affected environments, Wiz CIRT has not observed this IAM user in any activity other than that associated with this threat actor,” the trio wrote. This activity continued on October 15, and on October 18, the digital intruders began using a second IAM user from the same account…