TLDR Tech / InfoSec
Paved With Intent: ROADtools and Nation-State Tactics in the Cloud
ROADtools, an open-source Python framework for Entra ID enumeration and OAuth token manipulation, has evolved from a red-team utility into an attack platform adopted by nation-state actors, including Cloaked Ursa (APT29), Curious Serpens (APT33), and UTA0355, mapping cleanly to MITRE persistence (T1098.005 device registration), defense evasion (T1550), and discovery (T1087). The tool operates entirely through legitimate Microsoft APIs and customizable user-agent strings, so its activity blends into normal cloud operations and resists traditional file-based detection. The broader lesson is the dual-use dilemma of identity tooling: defenders should counter it with layered controls such as Entra ID token protection, conditional access restrictions on device code flow, OAuth app audits, and SIEM correlation of Graph API logs to surface scripted Python-based access and bursty enumeration.
Read the full story