Trusted cloud access exposes multiple AWS environments and data
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Wednesday, November 11th, 2026.
Multiple AWS environments had secrets and data accessed after a threat actor used credentials from an account associated with Qubole. Between October 14th and October 26th, the attacker assumed customer roles that still trusted the vendor account. Some of those roles had little or no recent legitimate use. The attacker enumerated resources, read secrets and Lambda environment variables, validated additional credentials, and downloaded accessible S3 data. The original method used to compromise the vendor-associated credentials remains unspecified.
The incident turned a routine integration into a cloud supply-chain risk. Dormant trust policies remained usable even when the integration wasn’t active. For leaders, every external account trusted by a cloud role extends the organization’s security boundary. For defenders, CloudTrail, S3 data logging, session revocation, and least-privilege role design are essential for finding and containing this kind of activity. The larger lesson is simple. Unused trust is still active access.
Organizations should audit external AWS trust relationships, remove unused roles, revoke suspicious sessions, and rotate every secret those sessions could read.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
