Nation‑State Actors Weaponize Open‑Source ROADtools for Cloud Attacks
Palo Alto Networks' Unit 42 details how attackers—including APT29 and APT33—use ROADtools, an open‑source Python framework, to enumerate Azure Entra ID, register devices, and manipulate tokens for cloud intrusion, persistence, and evasion. The report gives hunting queries and mitigation advice for defenders.