Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Paved With Intent: ROADtools and Nation-State Tactics in the Cloud

Summary: Unit 42 describes ROADtools, an open-source Python framework that targets Azure's identity and authentication layers through legitimate Microsoft APIs, with configurable user-agent strings to evade detection. Its roadrecon module enumerates Entra ID accounts, devices, roles and group membership into a local SQLite database, while roadtx acquires and exchanges OAuth 2.0 tokens, registers devices, and replays stolen tokens to bypass MFA; Unit 42 reports nation-state actors have used it for discovery, persistence and defense evasion, and that attackers in an early 2025 phishing campaign used tooling matching its token management capabilities.

Why it matters: A single compromised device-bound Primary Refresh Token can give an attacker persistent, programmatic access across the entire tenant, silently minting new access tokens without another login. ROADtools drops no binaries and exploits no memory flaws, so it looks like the authentication traffic your organization runs every day.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related