Threat Intelligence
The New Battlefield: How Iran’s Handala Group Crippled Stryker Corporation
A Fortune 500 medical technology giant left with 200,000 wiped devices, surgical supply chains halted, and cardiac monitoring systems taken offline — all without a single line of malware touching the network.
This post is a situation update to our previous analysis, Iran Conflict Cyber Operations: What It Means for Defenders. In that post, we outlined Iran’s expanding cyber doctrine and early indicators of infrastructure targeting. The events of March 2026 have confirmed and significantly accelerated that threat picture. We recommend reading both posts together for the full context.
On March 11, 2026, the Iranian-linked front “Handala” — attributed with high confidence to MOIS-affiliated actor Void Manticore — executed a devastating wiper campaign against Stryker Corporation. By weaponizing Microsoft Intune, attackers issued bulk factory reset commands across the company’s entire global device fleet without deploying a single line of malware. This marks a decisive shift from peripheral hacktivism to overt state-nexus industrial sabotage against Western corporations.
A New Phase in the Shadow War
When the dust settled on the morning of March 11, 2026, thousands of Stryker employees across 61 countries arrived at their desks to find their managed laptops and mobile devices completely wiped — replaced by a defaced login screen displaying the Handala logo. It was a stunning act of digital sabotage. But this was not the work of a rogue hacking collective.
The operation was a direct response to “Operation Epic Fury” — a joint U.S.–Israel offensive launched February 28 that included strikes on Bank Sepah in Tehran and a missile attack on a school in Minab, Iran. Iran’s IRGC cited these actions as the legal and moral justification for a multi-vector retaliatory campaign, abandoning the peripheral “hack-and-leak” model in favour of targeting the physical and administrative foundations of Western economic power.
Traditional EDR is insufficient when the adversary uses authorized tools to execute destruction. This is ‘living-off-the-cloud’ warfare.
Attack Timeline
| DATE | EVENT |
| Feb 28, 2026 | U.S. and Israel launch “Operation Epic Fury” and “Operation Roaring Lion,” including strikes on Bank Sepah, Tehran. IRGC cites these as justification for retaliatory campaign. |
| March 1, 2026 | IRGC deploys drone strikes against AWS data centers in the UAE and Bahrain, severing power and triggering fire suppression systems. Fiscal losses estimated in the tens to hundreds of billions. |
| March 11 — 00:00 EST | Handala launches against Stryker’s global Microsoft environment. Thrive assesses it is likely that AitM phishing was used to capture admin session tokens, bypassing MFA though the initial access vector has not been independently confirmed. |
| March 11 — Morning | Employees worldwide find managed devices wiped. Handala logo appears on login portals. BYOD personal devices — including employees’ personal photos and files — are also destroyed. |
| March 11 — 12:00 EST | Stryker files an 8-K with the SEC confirming a “global network disruption.” SYK stock falls 3.6–4.5%. Over 5,000 workers at the Cork, Ireland hub are sent home. |
| March 12, 2026 | CISA officially launches an investigation. Handala publicly claims responsibility, alleging 200,000 systems wiped and 50 TB of data exfiltrated — claims that remain unverified. |
Who Is Handala?
Handala presents itself as a Palestinian hacktivist collective, but analysts assess with high confidence that it functions as a “faketivist” front for Iran’s Ministry of Intelligence and Security (MOIS), specifically linked to the actor known as Void Manticore (also tracked as Banished Kitten). The group coordinates with other state-aligned proxies through the Electronic Operations Room, a Telegram-based command channel.
Since its emergence in December 2023, Handala has evolved into a Tier 2, operationally active threat. Its primary tactics, techniques, and procedures (TTPs) include:
- Infrastructure Obfuscation — Routing traffic through Starlink IP ranges to bypass geographic fencing.
- Sophisticated Phishing — Leveraging conflict-themed lures to harvest administrative credentials.
- Psychological Warfare — “Death Makers” doxxing campaigns that expose personal data of corporate executives and intelligence officers to amplify pressure.
The targeting of Stryker was not arbitrary. The adversary characterized the company as a “Zionist-rooted” corporation, framing the attack as proxy retaliation against U.S. and Israeli interests. Stryker’s 2019 acquisition of OrthoSpace, an Israeli medical technology firm, marked the company as a priority MOIS target. The operation also coincided with an unverified claim of a simultaneous breach at Verifone, suggesting a broader campaign against Western financial and technology ecosystems.
The Attack Vector: Weaponizing Your Own Security Infrastructure
The most consequential innovation of the Stryker campaign was not what the attackers deployed — it was what they didn’t deploy. This was a “wiper attack without malware.” By compromising Microsoft Intune — Stryker’s Mobile Device Management (MDM) platform — Handala achieved mass destruction likely without triggering a single EDR alert. Every command issued was, from the platform’s perspective, a legitimate administrative action.
Attack Chain
- AitM Phishing — Attackers deployed Adversary-in-the-Middle phishing to capture authenticated Entra session tokens, completely bypassing MFA without the victim receiving any notification.
- Privilege Escalation — Using the hijacked session, attackers escalated to Global Administrator or Intune Service Administrator roles within Microsoft Entra.
- Bulk Execution — From total administrative control, they issued bulk “Factory Reset” commands to Stryker’s entire global device fleet — simultaneously, at cloud speed.
Wiper Comparison: Traditional Malware vs. MDM Exploitation
| Feature | Standard Wiper Malware | MDM-Based Wiping (Stryker) |
| Detection Difficulty | High — signature/behavioral alerts | Critical: Legitimate admin activity |
| Deployment Speed | Moderate (propagation required) | Near-instant — cloud-delivered |
| Required Access | Local system or user | Administrative portal only |
| Resource Footprint | Discrete binary or script | Zero — native tools only |
| MITRE ATT&CK | T1561 (Disk Wipe) | T1072 (Software Deployment Tools) |
The Human Cost: Healthcare in the Crossfire
Handala’s choice of Stryker introduced a uniquely dangerous pressure vector: patient safety. Stryker is a manufacturer of surgical robotics, orthopedic implants, and emergency medical equipment. When its digital infrastructure collapsed, the consequences moved beyond the balance sheet.
The most acute impact was the outage of the LifeNet ECG transmission platform — used by paramedics to transmit cardiac data to emergency rooms ahead of patient arrival. Several hospitals suspended the platform as a precaution, forcing emergency teams to revert to manual radio consultations during life-threatening events. At manufacturing hubs in Costa Rica and Ireland, workers abandoned automated systems for pen-and-paper workflows, halting the global surgical supply chain.
Reported Impact: Handala Claims vs. Verified Evidence
| Metric | Handala Claims | Corporate / Independent Evidence |
| Data Exfiltration | 50 TB of sensitive data stolen | No confirmation; investigation ongoing |
| Device Impact | 200,000 systems and servers wiped | Global disruption; Intune managed devices reset |
| Malware Status | Deployed destructive wiper | “No indication of malware or ransomware” — SEC 8-K filing |
| Internal Impact | Total network shutdown claimed | 5,000 workers sent home in Ireland; Entra login defaced |
Resilience Signal
Stryker’s Mako robotic-arm surgery platform — because it operates independently via USB/CD and is not a network-connected device — remained fully functional throughout the attack. Offline and air-gapped systems proved their worth in the most direct way possible.
The Bigger Picture: Infrastructure Warfare Goes Kinetic
The Stryker campaign is one vector in a broader Iranian doctrine shift that analysts are calling “infrastructure warfare” — a hybrid model combining digital intrusion with physical destruction. Tehran has abandoned the peripheral hack-and-leak model in favor of targeting the physical and administrative foundations of Western economic power.
On March 1, 2026, just ten days before the Stryker attack, the IRGC deployed drone strikes against AWS data centers in the UAE and Bahrain. Strikes were multi-layered: direct impacts compromised physical housing, targeted strikes severed uninterruptible power supplies, and explosion-triggered fire suppression systems flooded server rooms, causing irreversible hardware damage. Regional services — including banking platforms, delivery logistics, and telecommunications — suffered cascading failures.
Meanwhile, Iranian threat actor MuddyWater (MOIS-linked) exploited Jerusalem-based servers hosting live CCTV streams, feeding real-time visual intelligence to Iranian military units for mid-flight missile trajectory adjustments. Israeli officials issued emergency warnings urging citizens to disconnect internet-connected security cameras. Separately, Imperial Kitten (IRGC-linked) had previously demonstrated a seamless handoff from digital AIS vessel tracking to Houthi kinetic strikes — a confirmed case of cyber-enabled targeting.
What Defenders Must Do Now
The Stryker attack demands a fundamental rethink of enterprise security architecture. When the adversary uses your own administrative tools against you, endpoint detection alone is not enough. The security perimeter must extend upward — into the identity and management planes that govern every device in your fleet.
- Require FIDO2 keys for all MDM administrators — Traditional SMS and authenticator app MFA is demonstrably insufficient against AitM phishing. Hardware security keys are the only currently viable defense against session token theft at this threat level.
- Implement multi-admin approval for destructive commands — Configure Intune and all UEM platforms to require quorum authorization before any bulk wipe or factory reset command executes.
- Real-time alerting on bulk administrative actions — Any mass “remote wipe” or “factory reset” command should trigger an immediate security alert and automatic hold, pending human review.
- Apply Just-In-Time (JIT) privileged access — Use privileged identity management to ensure elevated rights are only active during specific, audited, time-limited windows.
- Diversify cloud workloads away from geopolitical flashpoints — Evaluate immediate regional failover protocols away from AWS UAE, Bahrain, and Israel. Physical data center hardening must now account for military-grade kinetic threats, not just natural disasters.
- Hunt for Dindoor and Fakeset backdoors proactively — Search for pre-positioning indicators associated with MuddyWater/Seedworm: the Dindoor (Deno JavaScript runtime) and Fakeset (Python-based) backdoors that may indicate pending follow-on activity.
The Stryker attack is not a cautionary tale about one company’s security posture. It is a proof-of-concept for a new era of warfare — one in which your enterprise management infrastructure is the weapon, and any Western organization with ties to the conflict is a potential target. The administrative layer is the new front line. Defend it accordingly.