Sentra uncovered a wide supply chain attack through Qubole, impacting dozens of customers. An attacker obtained Qubole credentials and leveraged trusted vendor access to quietly pull data from multiple organizations. Sentra detected the campaign in under 24 hours, reporting it to Wiz and Mandiant.
The attack relied on dormant Qubole roles that retained data access long after companies stopped using the platform. Despite security measures like External IDs, the attacker used a rented OVH server and Mullvad VPN to mask activity. Sentra had previously flagged one role as unused but still capable of reaching sensitive data.
The incident highlights the risk of forgotten vendor trust and the need for Zero Trust and Data Detection and Response to limit blast radius and flag anomalous behavior. Wiz published full research on the incident.
Source: Hacker News · Summarized by HeadlinesBriefing