ROADtools Misuse in Cloud Intrusions — Nation-State Abuse of the Open-Source Entra ID Offensive Toolkit (Unit 42)
ROADtools Misuse in Cloud Intrusions (TL-2026-0561), also tracked as ROADtools abuse, is a high-severity cloud security threat, first published 2026-05-22. It is attributed to APT29 (Russia, Iran) with high confidence, affects Microsoft Entra ID (Azure Active Directory), maps to 17 MITRE ATT&CK techniques (T1069, T1071, T1078), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0561
- Threat ID
- TL-2026-0561
- Also known as
- ROADtools abuse, roadrecon enumeration, roadtx device registration, Entra ID PRT theft via roadtx
- Severity
- HIGH
- Status
- ACTIVE
- Category
- CLOUD
- First published
- 2026-05-22
- Last reviewed
- 2026-05-22
- Attribution
- APT29
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia, Iran
- Motivation
- ESPIONAGE
- Target sectors
- government, diplomatic, defense, energy, financial-services, technology, ngo, research
- Target regions
- North America, Europe, Middle East, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in ROADtools Misuse in Cloud Intrusions
Malware and tooling: OAuth device code flow, ROADTools - S0684, roadlib, roadrecon, roadtx
Unit 42 documents multiple nation-state actors — Cloaked Ursa (Midnight Blizzard/APT29), Curious Serpens (Peach Sandstorm/APT33), UTA0355, and Void Blizzard — integrating the open-source ROADtools framework (roadrecon, roadtx, roadlib) into Microsoft Entra ID intrusions. Operators use ROADtools to enumerate Entra ID tenants, register rogue devices, acquire and exchange OAuth refresh/access tokens including Primary Refresh Tokens (PRTs), and bypass MFA — all through legitimate Microsoft APIs that closely mimic typical administrative traffic and resist detection.
How ROADtools Misuse in Cloud Intrusions works
ROADtools is an open-source Python toolkit originally developed by Dirk-jan Mollema for offensive and defensive research against Microsoft Entra ID (formerly Azure AD). It comprises three primary modules — roadrecon for discovery and enumeration, roadtx for token acquisition/exchange and device registration, and roadlib as the low-level authentication and API library. Because every component speaks directly to legitimate Microsoft authentication endpoints (login.microsoftonline.com, graph.microsoft.com, enterpriseregistration.windows.net), ROADtools traffic is indistinguishable from normal Entra ID administrative activity unless defenders inspect granular signals such as user-agent strings, device registration metadata, OAuth scope combinations, and API call cadence.
Unit 42 (Palo Alto Networks) published a May 22, 2026 retrospective consolidating multiple public incidents in which state-sponsored threat actors leveraged ROADtools across the intrusion lifecycle. Microsoft first reported Cloaked Ursa (Midnight Blizzard / APT29 / Nobelium) abusing ROADtools in late 2021 after a spear-phishing initial-access stage to enumerate target Entra ID tenants. In 2023, Iranian-aligned Curious Serpens (Peach Sandstorm / APT33) followed password-spray initial access with roadrecon-based directory enumeration. In early 2025, Volexity reported on UTA0355 — a state-affiliated actor whose targeted phishing operation produced session-stealing artifacts whose token-handling behavior matched roadtx capabilities; the operator registered a rogue device into Entra ID and obtained an access token with full Microsoft Graph permissions. Void Blizzard activity has also been correlated to ROADtools-style tradecraft.
The end-to-end attack chain typically begins with credential theft (spear-phishing AiTM kits, password spray, or session cookie exfiltration). Once the operator holds a refresh token or session, roadtx is used to authenticate to the Azure Device Registration Service (urn:ms-drs:enterpriseregistration.windows.net) and register a new rogue device — defaults produce OS=Windows, OS Version=10.0.19041.928, and device names of the form DESKTOP-<RANDOM 8 DIGITS>. The registration returns a device-bound Primary Refresh Token (PRT) plus session transport key. With a device-bound PRT the operator can silently mint new access tokens for arbitrary first-party Microsoft scopes (Microsoft Graph, Azure AD Graph, Exchange Online, SharePoint, Teams) without re-triggering interactive sign-in or MFA challenges, achieving programmatic, tenant-wide persistence that survives standard credential reset.
With authenticated access in hand, roadrecon performs bulk enumeration of users, groups, directory roles, devices, service principals, applications, OAuth permission grants, conditional access policies, and tenant settings, storing results in a local SQLite database (roadrecon.db) and exposing a Flask/React web UI for offline analysis. Operators frequently target high-privilege OAuth scopes — Directory.ReadWrite.All, Device.ReadWrite.All, Application.ReadWrite.All, AuditLog.ReadWrite.All, Policy.ReadWrite.All — which together enable directory manipulation, persistence via service-principal credential injection, and audit-log tampering. roadtx also supports OAuth flow abuse including device code phishing, OBO (on-behalf-of) token exchange, and refresh-token replay across resource boundaries.
Detection is non-trivial because every ROADtools interaction is a legitimate API call from Microsoft's perspective. Reliable hunting pivots include: (1) Device Registration Service events from non-corporate locations or with default 10.0.19041.928 / DESKTOP- device names; (2) sign-ins or graph API calls with user-agent strings containing 'python', 'requests', 'urllib', 'curl', or literal 'roadtools'; (3) bursty Microsoft Graph enumeration of /users, /groups, /devices, /servicePrincipals, /applications endpoints exceeding tenant baselines; (4) OAuth token grants containing the high-privilege scope combinations above; (5) Entra ID Protection 'unfamiliar sign-in properties' or 'anonymous IP' risk events on accounts immediately followed by device registration. Recommended mitigations include enforcing token protection (client claims that bind refresh tokens to a device), Conditional Access policies that restrict device code flow and require compliant/Intune-managed devices for privileged scopes, strict OAuth app review with delegated/application-permission audits, PIM/just-in-time elevation for directory roles, and SIEM-side correlation of AzureActiveDirectorySignInLogs, MicrosoftGraphActivityLogs, AuditLogs, and OfficeActivity.
MITRE ATT&CK techniques used in TL-2026-0561
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1566 Phishing
Persistence
T1098 Account Manipulation; T1136 Create Account
Credential Access
T1110 Brute Force; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
lateral-movement
T1550 Use Alternate Authentication Material
defense-impairment
T1578 Modify Cloud Compute Infrastructure
Resource Development
Affected products and versions in ROADtools Misuse in Cloud Intrusions
- Microsoft — Entra ID (Azure Active Directory)
Vulnerable versions: all tenants without token protection / phishing-resistant MFA / device code flow restriction - Microsoft — Microsoft Graph API
Vulnerable versions: v1.0; beta - Microsoft — Azure AD Graph API (deprecated)
Vulnerable versions: all
Fixed in: deprecated; migrate to Microsoft Graph - Microsoft — Azure Device Registration Service
Vulnerable versions: urn:ms-drs:enterpriseregistration.windows.net
Remediation for ROADtools Misuse in Cloud Intrusions
Immediate actions
- Enable Conditional Access policy requiring compliant or Hybrid Azure AD Joined devices for all Microsoft Graph and Azure management scopes
- Block or scope down OAuth device code flow via Conditional Access (auth method: deviceCode -> block) except for explicitly enrolled service accounts
- Audit all devices registered in the last 90 days; quarantine those with OS Version 10.0.19041.928 and DESKTOP-<8 digit> naming pattern that lack Intune compliance
- Revoke refresh tokens and sign-in sessions (Revoke-AzureADUserAllRefreshToken / Revoke-MgUserSignInSession) for any user accounts implicated in suspicious device registrations
- Hunt for sign-ins and Graph API calls with user-agent containing python, python-requests, urllib, curl, or literal roadtools
- Review consented OAuth applications holding Directory.ReadWrite.All, Device.ReadWrite.All, Application.ReadWrite.All, AuditLog.ReadWrite.All, Policy.ReadWrite.All
Workarounds
- Where token protection cannot yet be enabled, restrict Microsoft Graph high-privilege scopes via app consent policies and admin-consent workflow
- Block sign-ins from non-corporate ASNs / anonymizer (Tor) IPs via Conditional Access named locations + risk-based policies
- Disable user-initiated device registration where business need does not exist (Entra ID -> Devices -> Device settings -> Users may register their devices: None or Selected)
Longer-term hardening
- Enforce Entra ID token protection (sign-in session token binding / client claims) on all sensitive resources to defeat refresh-token replay from non-original devices
- Adopt phishing-resistant MFA (FIDO2 / Windows Hello for Business / certificate-based) to break AiTM session theft prerequisites
- Deploy Privileged Identity Management (PIM) with just-in-time elevation, approval workflows, and access reviews for all Entra ID directory roles
- Centralize AzureActiveDirectorySignInLogs, MicrosoftGraphActivityLogs, AuditLogs, IdentityRiskEvents, and OfficeActivity into a SIEM with correlation rules for ROADtools tradecraft
- Adopt continuous access evaluation (CAE) so revoked sessions/tokens propagate to resource providers within minutes rather than hours
- Implement Microsoft Entra Workload Identity Protection and Defender for Cloud Apps anomaly policies tuned for unusual Graph enumeration volume
Weaknesses (CWE) in ROADtools Misuse in Cloud Intrusions
CWE-287, CWE-294, CWE-522, CWE-862
Timeline of ROADtools Misuse in Cloud Intrusions
- Dirk-jan Mollema releases ROADtools (roadrecon) as an open-source Entra ID / Azure AD enumeration and offensive research toolkit on GitHub.
- Microsoft Threat Intelligence reports Cloaked Ursa (Midnight Blizzard / APT29 / Nobelium) using ROADtools for Entra ID enumeration following spear-phishing initial access.
- Dirk-jan Mollema releases roadtx, adding OAuth token acquisition, exchange, refresh-token replay, and Entra ID device registration to the ROADtools framework.
- Microsoft publishes Peach Sandstorm (Curious Serpens / APT33) campaign report describing password-spray initial access followed by ROADtools/roadrecon enumeration of victim Entra ID tenants.
- ROADtools msgraph branch last updated; community forks maintain partial functionality as Microsoft accelerates Azure AD Graph deprecation.
- Volexity discloses UTA0355 targeted phishing campaign that stole refresh tokens, registered a rogue device with Entra ID via Azure Device Registration Service, and obtained Microsoft Graph access tokens with full-tenant scope — tradecraft matching roadtx token-management capabilities.
- Void Blizzard activity correlated to ROADtools-style tradecraft against NGO and government targets in Europe.
- Unit 42 publishes 'Paved With Intent: ROADtools and Nation-State Tactics in the Cloud', consolidating multi-actor abuse pattern, hunting queries (Cortex XQL), and defensive guidance.
- As of 2026-05-29, this remains ACTIVE: the Unit 42 "Paved With Intent" report (May 22, 2026) is verified and ROADtools stays freely available on GitHub, abusing legitimate Entra ID APIs with no possible patch (config-only defenses). Attributed actors APT29, APT33, UTA0355 and Void Blizzard are all currently operating, so the technique is a live concern.
Sources cited for ROADtools Misuse in Cloud Intrusions
- Paved With Intent: ROADtools and Nation-State Tactics in the Cloud
- ROADtools — Open-Source Entra ID Toolkit (GitHub)
- Updates to the MagicWeb threat actor (Microsoft Threat Intelligence on Nobelium / Midnight Blizzard)
- Volexity — Phishing for Primary Refresh Tokens (UTA0355 campaign)
- Microsoft — Peach Sandstorm password spray campaigns enable data exfiltration and back-door deployment
- MITRE ATT&CK T1098.005 Account Manipulation: Device Registration
- MITRE ATT&CK T1550 Use Alternate Authentication Material
- Microsoft — Token protection in Entra ID Conditional Access
More in cloud
- OAuth Client ID Spoofing Enables Stealthy Enumeration of Microsoft Entra ID Accounts (UNK_pyreq2323 / UNK_OutFlareAZ)
- Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)
- Password Spraying Campaign Targets AWS Root User Accounts Across 150+ Organizations
- AWS IAM Privilege Escalation Attack Path via iam:CreateAccessKey, iam:UpdateLoginProfile, and iam:UpdateAssumeRolePolicy (Horizon3.ai NodeZero Case Study)
- AWS SSM Agent Abused as a Living-off-the-Land Remote Access Trojan via Hybrid-Activation Hijacking and Parallel Agent Processes
Detection coverage for TL-2026-0561
As of 2026-05-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0561 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.