Trusted by Default: Qubole Cross-Account Access Abused in the Wild

A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments. Here's what we observed and how to hunt for it.