ROADtools Misuse in Cloud Intrusions — Nation-State Abuse of the Open-Source Entra ID Offensive Toolkit (Unit 42) — Threadlinqs Intelligence
As of 2026-05-30, ROADtools Misuse in Cloud Intrusions — Nation-State Abuse of the Open-Source Entra ID Offensive Toolkit (Unit 42) is a high-severity cloud threat attributed to APT29 (Russia / Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-0561 · Severity: HIGH · Status: ACTIVE · Category: CLOUD
Attribution: APT29 · Russia / Iran · ESPIONAGE
Unit 42 documents multiple nation-state actors — Cloaked Ursa (Midnight Blizzard/APT29), Curious Serpens (Peach Sandstorm/APT33), UTA0355, and Void Blizzard — integrating the open-source ROADtools
ROADtools is an open-source Python toolkit originally developed by Dirk-jan Mollema for offensive and defensive research against Microsoft Entra ID (formerly Azure AD). It comprises three primary modules — roadrecon for discovery and enumeration, roadtx for token acquisition/exchange and device registration, and roadlib as the low-level authentication and API library. Because every component speaks directly to legitimate Microsoft authentication endpoints (login.microsoftonline.com, graph.microsoft.com, enterpriseregistration.windows.net), ROADtools traffic is indistinguishable from normal Entra ID administrative activity unless defenders inspect granular signals such as user-agent strings, device registration metadata, OAuth scope combinations, and API call cadence.
Unit 42 (Palo Alto Networks) published a May 22, 2026 retrospective consolidating multiple public incidents in which state-sponsored threat actors leveraged ROADtools across the intrusion lifecycle. Microsoft first reported Cloaked Ursa (Midnight Blizzard / APT29 / Nobelium) abusing ROADtools in late 2021 after a spear-phishing initial-access stage to enumerate target Entra ID tenants. In 2023, Iranian-aligned Curious Serpens (Peach Sandstorm / APT33) followed password-spray initial access with roadrecon-based directory enumeration. In early 2025, Volexity reported on UTA0355 — a state-affiliated actor whose targeted phishing operation produced session-stealing artifacts whose token-handling behavior matched roadtx capabilities; the operator registered a rogue device into Entra ID and obtained an access token with full Microsoft Graph permissions. Void Blizzard activity has also been correlated to ROADtools-style tradecraft.
The end-to-end attack chain typically begins with credential theft (spear-phishing AiTM kits, password spray, or session cookie exfiltration). Once the operator holds a refresh token or session, roadtx is used to authenticate to the Azure Device Registration Service (urn:ms-drs:enterpriseregistration.windows.net) and register a new rogue device — defaults produce OS=Windows, OS Version=10.0.19041.928, and device names of the form DESKTOP-<RANDOM 8 DIGITS>. The registration returns a device-bound Primary Refresh Token (PRT) plus session transport key. With a device-bound PRT the operator can silently mint new access tokens for arbitrary first-party Microsoft scopes (Microsoft Graph, Azure AD Graph, Exchange Online, SharePoint, Teams) without re-triggering interactive sign-in or MFA challenges, achieving programmatic, tenant-wide persistence that survives standard credential reset.
With authenticated access in hand, roadrecon performs bulk enumeration of users, groups, directory roles, devices, service principals, applications, OAuth permission grants, conditional access policies, and tenant settings, storing results in a local SQLite database (roadrecon.db) and exposing a Flask/React web UI for offline analysis. Operators frequently target high-privilege OAuth scopes — Directory.ReadWrite.All, Device.ReadWrite.All, Application.ReadWrite.All, AuditLog.ReadWrite.All, Policy.ReadWrite.All — which together enable directory manipulation, persistence via service-principal credential injection, and audit-log tampering. roadtx also supports OAuth flow abuse including device code phishing, OBO (on-behalf-of) token exchange, and refresh-token replay across resource boundaries.
Detection is non-trivial because every ROADtools interaction is a legitimate API call from Microsoft's perspective. Reliable hunting pivots include: (1) Device Registration Service events from non-corporate locations or with default 10.0.19041.928 / DESKTOP- device names; (2) sign-ins or graph API calls with user-agent strings containing 'python', 'requests', 'urllib', 'curl', or literal 'roadtools'; (3) bursty Microsoft Graph enumeration of /users, /groups, /devices, /servicePrincipals, /applications endpoints exceeding tenant baselines; (4) OAuth token grants containing the h
Weaknesses (CWE)
CWE-287, CWE-294, CWE-522, CWE-862
Target sectors: government, diplomatic, defense, energy, financial-services, technology, ngo, research
Target regions: North America, Europe, Middle East, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
CLOUD, HIGH, threat intelligence, cybersecurity, T1588, T1566, T1078, T1110, T1528, T1539, T1098, T1098, T1136, T1550