Cobola's AWS chain of trust was abused in a multi-victim secret theft.
Wiz identified a supply chain breach where attackers used compromised Cobola AWS IAM credentials to perform cross-account roles in customer environments from October 14th onwards. Multiple organizations were affected, with access used to count resources and steal secrets from Lemma, Secret Manager, SSM Parameter Store, and S3. The researchers linked the activity to the Cobola account 805246085872 in the hacking of the supply chain.
The case highlights the risk of dormant third-party trust relationships. Deprecated integrations remained exploitable while the trust policy remained active, while converted credentials would not invalidate temporary sessions that had already been issued.
Open sources - closed narratives.