MalwareUsed by 1 actor

Roadtools

ROADTools is a publicly available cloud reconnaissance tool used to enumerate and collect data from Microsoft Entra ID (formerly Azure AD) environments. The provided content states that it automatically gathers data from Azure AD using the Azure AD Graph API, can enumerate Azure AD systems and devices, and leverages valid cloud credentials to perform enumeration through the internal Azure AD Graph API. Microsoft observed the Iranian nation-state actor Peach Sandstorm (HOLMIUM, with overlap to APT33/Elfin/Refined Kitten reporting) using ROADTools during post-compromise reconnaissance after successful password-spray activity, including to access Microsoft Entra ID data and dump that data to a database. The activity was associated with intrusions targeting organizations globally, particularly in the satellite, defense, and to a lesser extent pharmaceutical sectors. High-confidence behavior in the content is limited to Entra ID/Azure AD reconnaissance and data collection using valid credentials; no additional host-based infection vector or standalone malware persistence mechanism is described for ROADTools itself.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT33

"They used password spray activity, internal reconnaissance with AzureHound or Roadtools..."

via industrialcyberindustrialcyber.co

MITRE ATT&CK

Techniques & procedures

26 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

4 techniques

T1078Valid AccountsEvidence2

ROADtools operates through legitimate Microsoft APIs and can mimic typical traffic

T1078.004Cloud AccountsEvidence1

MITRE: T1078.004: Valid Accounts: Cloud Accounts ... The same user credentials that triggered AADSTS53003 on direct authentication now produced a token with amr: [pwd, rsa] and a deviceid claim.

T1566PhishingEvidence2

“Disable device-code flow for users who don't need it. roadrecon auth --device-code is the path of least resistance into the entire pipeline above and is extremely common in OAuth phishing.”

T1566.002Spearphishing LinkEvidence2

Attackers crafted customized Microsoft authentication URLs and required targets to open the URL, authenticate, and share the returned authorization code.

Execution

3 techniques

T1059.001PowerShellEvidence1

Mollema published the PowerShell proof-of-concept scripts in the ROADtools repository. The Hacker News found fido_assertion.ps1 and hellopoc.ps1 in the folder on August 6, 2026.

T1059.006PythonEvidence1

For threat hunting, defenders should look for scripted user agents such as strings containing “python-requests” or “urllib” appearing in authentication logs.

T1651Cloud Administration CommandEvidence1

Mandiant used the excellent ROADTools framework to gain further insight into the customer’s Entra ID environment, and discovered a service principal that was granted the DeviceManagementConfiguration.ReadWrite.All permission.

Persistence

6 techniques

T1078Valid AccountsEvidence2

ROADtools operates through legitimate Microsoft APIs and can mimic typical traffic

T1078.004Cloud AccountsEvidence1

MITRE: T1078.004: Valid Accounts: Cloud Accounts ... The same user credentials that triggered AADSTS53003 on direct authentication now produced a token with amr: [pwd, rsa] and a deviceid claim.

T1098Account ManipulationEvidence2

ROADtx uses stored tokens to perform device registration; the operation creates an Entra ID device entry and issues a device ID, PEM certificate, and private key.

T1098.005Device RegistrationEvidence2

A single roadtx device join command registered a phantom device with a signed Azure AD certificate and private key - no TPM, no hardware verification, no admin approval required. MITRE ATT&CK: T1098.005: Account Manipulation: Device Registration.

T1556.007Hybrid IdentityEvidence1

Intune does not validate that the device actually exists in on-premises Active Directory or that AD Connect synced it. It trusts the client's self-declared domain membership at enrollment... MITRE: T1556.007: Modify Authentication Process: Hybrid Identity

T1556.009Conditional Access PoliciesEvidence1

MITRE: T1098.005: Account Manipulation: Device Registration | T1556.009: Modify Authentication Process: Conditional Access Policies ... The CA policy governing device registration, CA027-001, was in Report-Only mode. It logged what would have happened. It blocked nothing.

Privilege Escalation

5 techniques

T1078Valid AccountsEvidence2

ROADtools operates through legitimate Microsoft APIs and can mimic typical traffic

T1078.004Cloud AccountsEvidence1

MITRE: T1078.004: Valid Accounts: Cloud Accounts ... The same user credentials that triggered AADSTS53003 on direct authentication now produced a token with amr: [pwd, rsa] and a deviceid claim.

T1098Account ManipulationEvidence2

ROADtx uses stored tokens to perform device registration; the operation creates an Entra ID device entry and issues a device ID, PEM certificate, and private key.

T1098.005Device RegistrationEvidence2

T1548Abuse Elevation Control MechanismEvidence1

Depending on the Entra ID configuration, these devices may also be used to bypass Conditional Access Policies.

Stealth

3 techniques

T1036MasqueradingEvidence2

The actors abused trusted first-party Microsoft applications to bypass traditional defenses; client IDs were specifically Visual Studio Code or Microsoft Authentication Broker.

T1078Valid AccountsEvidence2

ROADtools operates through legitimate Microsoft APIs and can mimic typical traffic

T1078.004Cloud AccountsEvidence1

MITRE: T1078.004: Valid Accounts: Cloud Accounts ... The same user credentials that triggered AADSTS53003 on direct authentication now produced a token with amr: [pwd, rsa] and a deviceid claim.

Defense Impairment

2 techniques

T1556.007Hybrid IdentityEvidence1

T1556.009Conditional Access PoliciesEvidence1

Credential Access

5 techniques

T1528Steal Application Access TokenEvidence6

Once a target authenticates, the authorization code is exchanged for a refresh token and/or access token, enabling the attacker to make Graph API calls without further user interaction.

T1556.007Hybrid IdentityEvidence1

T1556.009Conditional Access PoliciesEvidence1

T1621Multi-Factor Authentication Request GenerationEvidence2

the framework features a powerful token exchange module called roadtx ... it supports multiple authentication flows including device code techniques

T1649Steal or Forge Authentication CertificatesEvidence3

The new work removes that requirement by treating the Windows Hello for Business key as a FIDO2 passkey through WebAuthn.

Discovery

4 techniques

T1069Permission Groups DiscoveryEvidence2

They enumerate users, groups, roles, applications and service principals.

T1069.003Cloud GroupsEvidence1

“gather walks every interesting object type in the directory (users, groups, service principals, applications, devices, directory roles, role assignments, eligible role assignments, OAuth2 permission grants, administrative units).”

T1087.004Cloud AccountEvidence3

“ROADrecon's gather command uses aiohttp by default and walks every directory object type” and produces “Bulk enumeration across every object type ROADrecon knows.”

T1526Cloud Service DiscoveryEvidence6

they use her token to make Graph API calls like GET /users , GET /groups , GET /directoryRoles and GET /applications . In other words, they map the tenant and look for valuable access.

Lateral Movement

3 techniques

T1550Use Alternate Authentication MaterialEvidence2

By obtaining a Primary Refresh Token (PRT), an attacker can continuously generate new access tokens in the background without triggering another login prompt. This effectively allows them to operate inside a compromised tenant for extended periods while bypassing MFA controls entirely.

T1550.001Application Access TokenEvidence2

With the phantom device certificate and valid credentials, a PRT was requested... MITRE: T1550.001: Use Alternate Authentication Material: Application Access Token.

T1550.004Web Session CookieEvidence1

The detections seek suspicious reuse of the same session ID across multiple IPs, potentially indicating session hijacking or token abuse.

Collection

3 techniques

T1114.002Remote Email CollectionEvidence1

With the access token in hand, the attacker interacts with the Microsoft Graph API endpoint /v1.0/me/messages to extract email messages from the victim's account.

T1119Automated CollectionEvidence1

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.

T1530Data from Cloud StorageEvidence1

One was available and downloaded successfully... The .intunewin format is an encrypted ZIP... The deployment script inside the package referenced: Execute-Process -Path "\\INTSVR01\AdminPoint\setup.exe" ... MITRE: T1530: Data from Cloud Storage

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

palo alto networks unit 42 blogNews

Jun 25, 2025

Threat Brief: Escalation of Cyber Risk Related to Iran (Updated June 30)

Reconnaissance tool used for data collection from Microsoft Entra ID (Azure AD) environments.

industrialcyberNews

Sep 15, 2023

Peach Sandstorm Iranian APT hackers use password spraying to target satellite, defense, pharmaceutical sectors - Industrial Cyber

Open-source toolkit commonly used to enumerate and interact with Azure AD/Entra ID, supporting reconnaissance and follow-on actions in cloud identity environments.

microsoft security blogNews

Sep 14, 2023

Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets | Microsoft Security Blog

Framework used to access and enumerate Microsoft Entra ID data and dump collected information into a database; legitimate admin/red-team utility that can be repurposed for adversary reconnaissance.

mitre attack websiteNews

Mar 13, 2020

Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®

An Azure AD-focused enumeration tool that uses valid cloud credentials and the internal Azure AD Graph API.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping26

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Roadtools