200K+

Devices Wiped

79

Countries Affected

50TB

Data Claimed Stolen

$25B

Company Revenue

The Story

Early Wednesday morning, employees of medical technology giant Stryker across the United States, Ireland, Australia, Costa Rica, and India began reporting that their work devices had been remotely wiped. Laptops showed the Handala hacktivist logo on login screens. Corporate phones and tablets enrolled in the company's device management system were factory reset without warning. Within hours, Stryker's global operations were effectively offline.

Stryker manufactures surgical equipment, orthopedic implants, and neurotechnology used in hospitals worldwide. The company employs roughly 56,000 people and reported over $25 billion in revenue for 2025. It is a critical node in the global healthcare supply chain.

Handala, an Iran-linked hacktivist group that Palo Alto Networks assesses as a persona maintained by Void Manticore (an actor affiliated with Iran's Ministry of Intelligence and Security), claimed responsibility. The group said the attack was in retaliation for a US missile strike that hit a school in the Iranian city of Minab on February 28, killing over 175 people, most of them children. Handala called it the beginning of "a new chapter in cyber warfare."

The attack vector is what makes this incident significant from a technical standpoint. According to reporting from Krebs on Security and corroborated by employees posting on Reddit, the attackers appear to have compromised administrative accounts and used Microsoft Intune, Stryker's own cloud-based mobile device management (MDM) platform, to issue remote wipe commands against all connected devices. Intune is designed for exactly this purpose: IT teams use it to enforce compliance, push configurations, and, when necessary, remotely wipe lost or compromised devices. Handala simply pointed the tool at everything.

The damage extended beyond corporate assets. Employees who had enrolled personal phones for work access through Intune's Company Portal also had their personal devices wiped. Staff were instructed to immediately uninstall Intune, the Company Portal app, Teams, and VPN clients from any remaining personal devices. Many lost two-factor authentication credentials stored on wiped phones, locking them out of both work and personal accounts.

Stryker filed a Form 8-K with the SEC on Wednesday confirming a cybersecurity incident affecting its entire Microsoft environment. The company said it has no timeline for when full operations will be restored. The attackers also defaced Stryker's Microsoft Entra login pages with the Handala logo and claimed to have exfiltrated 50 terabytes of data before executing the wipe.

The Adversary Perspective

From an offensive security lens, this is one of the most efficient destructive attacks we have seen in a corporate environment. The attackers did not need custom wiper malware. They did not need to deploy a binary to 200,000 endpoints. They compromised the administrative layer of a tool the company already trusted with full device control, and issued a single category of command. The MDM platform did the rest.

This inverts the traditional wiper playbook. In the 2012 Shamoon attack against Saudi Aramco, the attackers had to propagate destructive malware across the network. In Russia's wiper campaigns against Ukraine, custom malware families were developed and deployed endpoint by endpoint. Handala skipped all of that. They compromised the cloud admin console and let Microsoft's own infrastructure execute the destruction.

The blast radius was maximized by design. MDM platforms like Intune have the ability to wipe every enrolled device simultaneously, across every geography, without requiring network adjacency or lateral movement within the corporate LAN. An attacker with Intune Global Administrator or Intune Service Administrator privileges can execute a full wipe in minutes from a browser.

The BYOD dimension makes this even worse. Employees who enrolled personal phones for work email access via Intune were caught in the blast. Their personal photos, messages, and data were destroyed alongside corporate assets. This is the risk that BYOD MDM enrollment has always carried, now realized at scale.

Figure 01

  1. STEP 01

    Initial Access

    Compromise of administrative accounts with access to Stryker's Microsoft cloud environment. Exact vector not yet publicly confirmed. Handala is known for phishing and supply-chain footholds via IT/service providers.
  2. STEP 02 // CRITICAL

    Privilege Escalation to MDM Admin

    Attacker obtained Intune administrative privileges (Global Administrator or Intune Service Administrator role in Entra ID). This single privilege grants the ability to remotely manage every enrolled device in the tenant.
  3. STEP 03

    Data Exfiltration

    Handala claims 50TB of data was exfiltrated prior to the wipe. Likely pulled from SharePoint, OneDrive, Exchange, and file shares accessible through the compromised admin credentials.
  4. STEP 04 // CRITICAL

    Entra Login Page Defacement

    Attackers customized the Microsoft Entra ID login pages to display Handala branding. This is a native Entra capability available to tenant admins, not a web server compromise.
  5. STEP 05 // CRITICAL

    Mass Remote Wipe via Intune

    Remote wipe commands issued through Microsoft Intune against all enrolled devices: Windows laptops, servers, iOS and Android phones, tablets. Both corporate-owned and BYOD-enrolled personal devices were wiped simultaneously across 79 countries.
  6. STEP 06 // CRITICAL

    Global Operational Shutdown

    With devices wiped and cloud identity infrastructure defaced, Stryker's operations halted globally. MFA tokens on wiped phones locked employees out of remaining systems. Some locations reverted to pen and paper. SEC 8-K filed.

Threat Actor Profile

  • Group: Handala (aka Handala Hack Team, Hatef, Hamsa)
  • Attribution: Void Manticore / Iran MOIS (Palo Alto Networks, IBM X-Force)
  • Active Since: December 2023
  • Known TTPs: Phishing, custom wiper malware, hack-and-leak, supply chain footholds, MDM abuse
  • Target Set: Israeli infrastructure, Gulf energy sector, Western companies with Israeli ties
  • Weapon Used Here: Microsoft Intune remote wipe (legitimate MDM capability)
  • Victim: Stryker Corporation (NYSE: SYK), $25B+ revenue, 56,000 employees

Defensive Takeaways

  1. 1

    Treat MDM Admin Accounts as Tier-0 Privileged Access

    Intune Global Administrator and Intune Service Administrator roles can wipe every device in your tenant. These accounts should be protected with the same rigor as domain admin credentials: hardware MFA tokens (not phone-based), Privileged Identity Management with just-in-time activation, conditional access policies restricting sign-in to compliant workstations, and continuous monitoring. If your MDM admin accounts are protected only by standard MFA and a password, you are one phish away from this scenario.

  2. 2

    Implement Bulk Action Limits and Alerting on MDM Wipe Commands

    A mass remote wipe across 200,000 devices should trigger every alarm in the building. If your monitoring does not alert on bulk wipe commands issued from Intune, you have a detection gap that this exact attack exploits. Configure alerts for any wipe, retire, or factory reset action exceeding a threshold (even 10 simultaneous wipes is abnormal in most orgs). Build automation to temporarily suspend MDM administrative actions when anomalous volumes are detected.

  3. 3

    Separate BYOD from Corporate Wipe Scope

    Personal devices enrolled in Intune with full MDM profiles are subject to the same remote wipe commands as corporate devices. Use Intune's "App Protection Policies" (MAM without enrollment) for BYOD scenarios wherever possible. This approach protects corporate data without giving your MDM platform the ability to factory reset an employee's personal phone. If full enrollment is required for BYOD, implement a separate enrollment profile with restricted wipe scope limited to corporate data only.

  4. 4

    Secure Entra ID Tenant Customization and Conditional Access

    The attackers defaced Stryker's Entra login pages using native tenant branding capabilities. Lock down who can modify tenant-level branding, conditional access policies, and identity configurations. Restrict these operations to a small group of hardened identities monitored by your SOC. Any modification to Entra branding, login page customization, or conditional access rules should trigger an immediate investigation.

  5. 5

    Ensure MFA Recovery Paths Survive a Device Wipe

    When phones used for MFA are wiped, employees lose access to everything. This cascading lockout turns a device destruction event into a total identity crisis. Ensure your MFA strategy includes backup methods that survive device loss: hardware security keys (FIDO2), printed recovery codes stored securely, or alternative authentication paths that do not depend on a single device. Test your recovery procedures assuming every phone and laptop in the company has been simultaneously wiped.