Loading story…
Stryker Corporation confirmed a significant cyber incident affecting its global Microsoft environment, with the Iran-linked threat actor Handala claiming responsibility. Reporting indicates the operation was politically motivated and destructive rather than financially driven, with no clear signs of ransomware or conventional malware. The attackers are believed to have abused Microsoft Intune or related endpoint management capabilities to issue remote wipe actions across corporate devices, disrupting operations and reportedly impacting thousands of servers, laptops, and smartphones; Handala also claimed to have exfiltrated as much as 50 TB of corporate data.
In response, CISA warned that malicious actors are targeting endpoint management systems at U.S. organizations and tied its alert to the March 11 attack on Stryker. The agency said it is coordinating with the FBI and urged organizations to harden endpoint management platforms, especially Microsoft Intune, by applying least-privilege access, enforcing phishing-resistant MFA, using Microsoft Entra ID protections, and requiring Multi Admin Approval for sensitive actions such as device wipes, scripts, RBAC changes, and configuration changes. The incident underscores how legitimate administrative tooling can be turned into a destructive attack path when privileged access is compromised.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
By 2026-04-02, Stryker said it was fully operational again following the March 11 destructive cyberattack. The company said manufacturing, commercial, ordering, and distribution systems had been sufficiently restored, production was moving toward peak capacity, and product supply remained healthy.
By 2026-03-25, Stryker disclosed that it had contained the cyber incident and was restoring operations, though recovery remained slow. The company said manufacturing disruption was still affecting its Cork, Ireland facilities and that the full financial impact had not yet been determined.
By 2026-03-20, follow-on reporting said the FBI and CISA were pushing U.S. organizations to strengthen Microsoft Intune security after the Stryker compromise, including second-admin approval for sensitive actions such as device wiping. The reporting also stated the attack reportedly wiped more than 200,000 devices.
On 2026-03-18, CISA published an alert after identifying malicious activity targeting endpoint management systems at U.S. organizations, citing the Stryker incident. The agency said it was coordinating with federal partners including the FBI and urged organizations to apply Microsoft Intune hardening measures and related zero-trust, RBAC, MFA, and privileged access protections.
On 2026-03-16, Stryker said the cyberattack was limited to its internal Microsoft corporate environment and did not affect its medical products, including connected and life-saving technologies. The company said the incident was not ransomware, found no evidence of data exfiltration, and confirmed major disruption from remote wiping of employee devices and electronic ordering systems.
On 2026-03-11, Stryker Corporation was hit by a cyberattack affecting its global Microsoft environment. Reporting tied the incident to Iran-linked actor Handala and described destructive activity including large-scale device wiping.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
11 references tracked. Mallory keeps watching after this page renders.
huntress.com
Open sourcebleepingcomputer.com
Open sourcehealth-isac.org
Open sourcethecyberthrone.in
Open sourcescworld.com
Open sourcekaseya.com
Open sourcecisa.gov
Open sourceeur02.safelinks.protection.outlook.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Iran-linked operators allegedly combined **MuddyWater** pre-positioning with **Handala** destructive actions to cripple Stryker by abusing Microsoft Intune rather than deploying ransomware or a conventional wiper. The reports say attackers stole a privileged session, elevated access through an **Entra ID PIM** design gap that accepted an existing MFA claim, and then used Intune API bulk **Wipe** and **Retire** actions to erase about **200,000 devices** across **61 countries**, disrupting roughly **56,000 employees**. Supporting reporting ties the operation to MOIS-linked infrastructure, malware including **Dindoor** and **Fakeset**, and data theft activity using **Rclone** before the destructive phase.
Jul 12, 2026
The **FBI** seized two websites used by the pro-Iranian hacktivist group **Handala** after the group claimed responsibility for a destructive cyberattack against **Stryker**. The seized domains, including Handala’s leak and publicity sites, were replaced with a U.S. law enforcement banner stating the infrastructure was used to support malicious cyber activity conducted on behalf of, or in coordination with, a foreign state actor. Reporting indicates the domains’ nameservers were changed to FBI-controlled infrastructure, and Handala later acknowledged on Telegram that its sites had been taken offline. The takedown followed a major intrusion into Stryker’s Microsoft environment that was described as highly destructive and involved abuse of legitimate **endpoint management** capabilities to wipe large numbers of devices and exfiltrate data. Public reporting differs on the scale of the impact, with estimates ranging from roughly **80,000** to **200,000** affected systems, while CISA said the incident should be treated as a warning that cyber activity tied to Middle East conflict may spill into U.S. organizations. CISA urged defenders to harden platforms such as **Microsoft Intune** by enforcing least privilege, role-based access controls, phishing-resistant MFA, and approval workflows for sensitive actions such as device wiping.
Jun 29, 2026
U.S. medical device manufacturer **Stryker** reported a severe, global disruption to its Microsoft/Windows environment following a cyberattack that left employees unable to access corporate systems. Staff reported corporate laptops and phones being wiped, widespread outages of work applications and email, and some login pages displaying the **Handala** logo; the company also routed calls to an automated message citing a “building emergency.” Stryker said it is experiencing a “global network disruption,” believes the incident is contained, and stated it has **no indication of ransomware** while working to restore operations using business continuity measures. A pro-Iran hacktivist group calling itself **Handala** publicly claimed responsibility, framing the attack as retaliation tied to the U.S.-Iran conflict and citing a reported U.S. strike on a girls’ school in Tehran. The group alleged it wiped large numbers of systems and exfiltrated significant data, and reporting indicated at least partial corroboration of system wiping and defacement across Stryker’s global environment. The incident appears to have caused broad operational impact across Stryker’s international footprint, with claims and employee reports indicating both destructive activity (device/server wiping) and potential data theft, though Stryker’s public statement did not confirm exfiltration.
Aug 17, 2026