# ROADtools Misuse in Cloud Intrusions — Nation-State Abuse of the Open-Source Entra ID Offensive Toolkit (Unit 42)

> Unit 42 documents multiple nation-state actors — Cloaked Ursa (Midnight Blizzard/APT29), Curious Serpens (Peach Sandstorm/APT33), UTA0355, and Void Blizzard — integrating the open-source ROADtools framework (roadrecon, roadtx, roadlib) into Microsoft Entra ID intrusions. Operators use ROADtools to enumerate Entra ID tenants, register rogue devices, acquire and exchange OAuth refresh/access tokens including Primary Refresh Tokens (PRTs), and bypass MFA — all through legitimate Microsoft APIs that closely mimic typical administrative traffic and resist detection.

- **Published:** 2026-05-22T12:00:00Z
- **Last reviewed:** 2026-05-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0561
- **ID:** TL-2026-0561
- **Severity:** HIGH
- **Category:** CLOUD
- **Status:** ACTIVE
- **Actor:** APT29 (Russia, Iran)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ROADtools is an open-source Python toolkit originally developed by Dirk-jan Mollema for offensive and defensive research against Microsoft Entra ID (formerly Azure AD). It comprises three primary modules — roadrecon for discovery and enumeration, roadtx for token acquisition/exchange and device registration, and roadlib as the low-level authentication and API library. Because every component speaks directly to legitimate Microsoft authentication endpoints (login.microsoftonline.com, graph.microsoft.com, enterpriseregistration.windows.net), ROADtools traffic is indistinguishable from normal Entra ID administrative activity unless defenders inspect granular signals such as user-agent strings, device registration metadata, OAuth scope combinations, and API call cadence.

Unit 42 (Palo Alto Networks) published a May 22, 2026 retrospective consolidating multiple public incidents in which state-sponsored threat actors leveraged ROADtools across the intrusion lifecycle. Microsoft first reported Cloaked Ursa (Midnight Blizzard / APT29 / Nobelium) abusing ROADtools in late 2021 after a spear-phishing initial-access stage to enumerate target Entra ID tenants. In 2023, Iranian-aligned Curious Serpens (Peach Sandstorm / APT33) followed password-spray initial access with roadrecon-based directory enumeration. In early 2025, Volexity reported on UTA0355 — a state-affiliated actor whose targeted phishing operation produced session-stealing artifacts whose token-handling behavior matched roadtx capabilities; the operator registered a rogue device into Entra ID and obtained an access token with full Microsoft Graph permissions. Void Blizzard activity has also been correlated to ROADtools-style tradecraft.

The end-to-end attack chain typically begins with credential theft (spear-phishing AiTM kits, password spray, or session cookie exfiltration). Once the operator holds a refresh token or session, roadtx is used to authenticate to the Azure Device Registration Service (urn:ms-drs:enterpriseregistration.windows.net) and register a new rogue device — defaults produce OS=Windows, OS Version=10.0.19041.928, and device names of the form DESKTOP-<RANDOM 8 DIGITS>. The registration returns a device-bound Primary Refresh Token (PRT) plus session transport key. With a device-bound PRT the operator can silently mint new access tokens for arbitrary first-party Microsoft scopes (Microsoft Graph, Azure AD Graph, Exchange Online, SharePoint, Teams) without re-triggering interactive sign-in or MFA challenges, achieving programmatic, tenant-wide persistence that survives standard credential reset.

With authenticated access in hand, roadrecon performs bulk enumeration of users, groups, directory roles, devices, service principals, applications, OAuth permission grants, conditional access policies, and tenant settings, storing results in a local SQLite database (roadrecon.db) and exposing a Flask/React web UI for offline analysis. Operators frequently target high-privilege OAuth scopes — Directory.ReadWrite.All, Device.ReadWrite.All, Application.ReadWrite.All, AuditLog.ReadWrite.All, Policy.ReadWrite.All — which together enable directory manipulation, persistence via service-principal credential injection, and audit-log tampering. roadtx also supports OAuth flow abuse including device code phishing, OBO (on-behalf-of) token exchange, and refresh-token replay across resource boundaries.

Detection is non-trivial because every ROADtools interaction is a legitimate API call from Microsoft's perspective. Reliable hunting pivots include: (1) Device Registration Service events from non-corporate locations or with default 10.0.19041.928 / DESKTOP- device names; (2) sign-ins or graph API calls with user-agent strings containing 'python', 'requests', 'urllib', 'curl', or literal 'roadtools'; (3) bursty Microsoft Graph enumeration of /users, /groups, /devices, /servicePrincipals, /applications endpoints exceeding tenant baselines; (4) OAuth token grants containing the high-privilege scope combinations above; (5) Entra ID Protection 'unfamiliar sign-in properties' or 'anonymous IP' risk events on accounts immediately followed by device registration. Recommended mitigations include enforcing token protection (client claims that bind refresh tokens to a device), Conditional Access policies that restrict device code flow and require compliant/Intune-managed devices for privileged scopes, strict OAuth app review with delegated/application-permission audits, PIM/just-in-time elevation for directory roles, and SIEM-side correlation of AzureActiveDirectorySignInLogs, MicrosoftGraphActivityLogs, AuditLogs, and OfficeActivity.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1566 Phishing
- T1078 Valid Accounts
- T1110 Brute Force
- T1528 Steal Application Access Token
- T1539 Steal Web Session Cookie
- T1098 Account Manipulation
- T1136 Create Account
- T1550 Use Alternate Authentication Material
- T1578 Modify Cloud Compute Infrastructure
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1071 Application Layer Protocol

## Sources

- [Paved With Intent: ROADtools and Nation-State Tactics in the Cloud](https://unit42.paloaltonetworks.com/roadtools-cloud-attacks/)
- [ROADtools — Open-Source Entra ID Toolkit (GitHub)](https://github.com/dirkjanm/ROADtools)
- [Updates to the MagicWeb threat actor (Microsoft Threat Intelligence on Nobelium / Midnight Blizzard)](https://www.microsoft.com/en-us/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/)
- [Volexity — Phishing for Primary Refresh Tokens (UTA0355 campaign)](https://www.volexity.com/blog/2025/04/22/phishing-for-primary-refresh-tokens-and-entra-id-device-registration/)
- [Microsoft — Peach Sandstorm password spray campaigns enable data exfiltration and back-door deployment](https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/)
- [MITRE ATT&CK T1098.005 Account Manipulation: Device Registration](https://attack.mitre.org/techniques/T1098/005/)
- [MITRE ATT&CK T1550 Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550/)
- [Microsoft — Token protection in Entra ID Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0561