Loading story…
Iran-linked operators allegedly combined MuddyWater pre-positioning with Handala destructive actions to cripple Stryker by abusing Microsoft Intune rather than deploying ransomware or a conventional wiper. The reports say attackers stole a privileged session, elevated access through an Entra ID PIM design gap that accepted an existing MFA claim, and then used Intune API bulk Wipe and Retire actions to erase about 200,000 devices across 61 countries, disrupting roughly 56,000 employees. Supporting reporting ties the operation to MOIS-linked infrastructure, malware including Dindoor and Fakeset, and data theft activity using Rclone before the destructive phase.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
On April 16, 2026, ThreatHunter.ai published a consolidated detection pack describing a two-phase Iranian state-linked operation against Stryker, attributing pre-positioning to MuddyWater and the destructive action to Handala. The release added a unified IOC and detection package focused on identity-layer abuse, Intune wipe activity, MuddyWater tooling, and related infrastructure.
The reported Red Menshen espionage campaign expanded into European telecommunications infrastructure and continued through March 2026. Operators moved from earlier footholds into sensitive mobile core environments, including OSS/NMS/EMS systems, Kubernetes-hosted 5G functions, and SCTP signaling-related areas.
On March 19, 2026, ThreatHunter.ai published an analysis arguing that CISA's endpoint management hardening advice did not fully address the March 11 Stryker attack path. It said Intune Multi Admin Approval alone was insufficient against a Global Admin and recommended no standing Global Admin roles, JIT PIM activation, and fresh phishing-resistant FIDO2 authentication at role activation.
ThreatHunter.ai released a second detection pack on March 14, 2026 covering MuddyWater pre-positioning, Entra ID PIM token-abuse risks, bulk wipe controls, stale-session privileged operations, and Rclone exfiltration. The package included Sigma rules, KQL hunting queries, and IOC updates tied to malware and infrastructure associated with the campaign.
At 3:30 AM EDT on March 11, 2026, attackers used a compromised Global Administrator session and Microsoft Intune API bulk Wipe and Retire actions to destroy about 200,000 systems across 61 countries, disrupting roughly 56,000 employees. The operation is described as destructive rather than ransomware-based and is attributed to Handala, with prior pre-positioning linked to MuddyWater.
A newly documented intrusion set attributed with high confidence to the China-nexus actor Red Menshen was active by at least July 2024, using BPFdoor and related tooling against telecommunications providers. The campaign initially involved compromises through edge devices, VPN access, and transport-network management systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
threathunter.ai
Open sourcemrtiepolo.medium.com
Open sourcethreathunter.ai
Open sourcethreathunter.ai
Open sourcehaxrob.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Stryker Corporation** confirmed a significant cyber incident affecting its global Microsoft environment, with the Iran-linked threat actor **Handala** claiming responsibility. Reporting indicates the operation was politically motivated and destructive rather than financially driven, with no clear signs of ransomware or conventional malware. The attackers are believed to have abused **Microsoft Intune** or related endpoint management capabilities to issue remote wipe actions across corporate devices, disrupting operations and reportedly impacting thousands of servers, laptops, and smartphones; Handala also claimed to have exfiltrated as much as **50 TB** of corporate data. In response, **CISA** warned that malicious actors are targeting endpoint management systems at U.S. organizations and tied its alert to the March 11 attack on Stryker. The agency said it is coordinating with the **FBI** and urged organizations to harden endpoint management platforms, especially **Microsoft Intune**, by applying least-privilege access, enforcing phishing-resistant MFA, using **Microsoft Entra ID** protections, and requiring **Multi Admin Approval** for sensitive actions such as device wipes, scripts, RBAC changes, and configuration changes. The incident underscores how legitimate administrative tooling can be turned into a destructive attack path when privileged access is compromised.
Jun 29, 2026
The **FBI** seized two websites used by the pro-Iranian hacktivist group **Handala** after the group claimed responsibility for a destructive cyberattack against **Stryker**. The seized domains, including Handala’s leak and publicity sites, were replaced with a U.S. law enforcement banner stating the infrastructure was used to support malicious cyber activity conducted on behalf of, or in coordination with, a foreign state actor. Reporting indicates the domains’ nameservers were changed to FBI-controlled infrastructure, and Handala later acknowledged on Telegram that its sites had been taken offline. The takedown followed a major intrusion into Stryker’s Microsoft environment that was described as highly destructive and involved abuse of legitimate **endpoint management** capabilities to wipe large numbers of devices and exfiltrate data. Public reporting differs on the scale of the impact, with estimates ranging from roughly **80,000** to **200,000** affected systems, while CISA said the incident should be treated as a warning that cyber activity tied to Middle East conflict may spill into U.S. organizations. CISA urged defenders to harden platforms such as **Microsoft Intune** by enforcing least privilege, role-based access controls, phishing-resistant MFA, and approval workflows for sensitive actions such as device wiping.
Jun 29, 2026
Researchers linked **Handala Hack** to Iran’s Ministry of Intelligence and Security as part of the broader **Void Manticore** cluster, describing a coordinated campaign that targeted organizations in Israel, Albania, and the United States with disruptive and destructive intrusions. Reported victims and incidents included attacks on **Stryker**, compromises affecting kindergarten emergency alert systems, and a personal Gmail breach publicly attributed to FBI Director Kash Patel that the FBI said involved historical, non-classified data. U.S. authorities also seized four domains allegedly used by the operation to leak stolen data, publicize attacks, and support influence activity. Investigators said the intrusions commonly began with **compromised VPN credentials**, followed by hands-on-keyboard movement over **RDP**, use of **NetBird** for tunneling, credential theft, Active Directory reconnaissance, and staged malware delivery. The destructive phase combined multiple methods at once, including a custom **Handala Wiper**, **PowerShell-based wiping**, **VeraCrypt** encryption, manual deletion of files and virtual machines, and tooling tied to webshell persistence, Telegram-linked data exfiltration, driver-assisted disk access, and attempts to disable endpoint defenses. Analysts also tied Handala to other MOIS personas including **Homeland Justice** and **Karma**, saying the fronts shared infrastructure, domain patterns, Telegram-based communications, and overlapping tradecraft in a single coordinated state-backed campaign.
Jun 29, 2026