A trusted Cobola access to AWS is used to reach customer accounts.
Attackers abused AWS's trusted Cobols approach to compromise customer cloud accounts and extract data. The penetration path centered on inherited trust between the data platform and the customer's AWS environments, allowing activity within accounts without direct theft of customer credentials being the primary access point.
The case highlights a recurring risk in the cloud: third-party integrations can become preferred transition paths for multi-tenant environments. For defenders, the key issue is not just vendor compromise, but how far delegated trust in IAM, role assumptions, and platform-level access can be extended after a connected service is abused.
Open sources - closed narratives.