Iran-Linked Hackers Weaponize Microsoft Intune to Wipe 200,000 Stryker Devices in Retaliatory Cyberattack
Pro-Iran hacktivist group Handala hijacked Stryker's Microsoft Intune tenant to remotely wipe over 200,000 systems across 79 countries, crippling the medical device giant and threatening global hospital supply chains.
Overview
Stryker Corporation, a $100 billion medical technology company that supplies orthopedic implants and surgical equipment to hospitals worldwide, disclosed on March 11 that it suffered “a global network disruption to our Microsoft environment as a result of a cyberattack.” Within hours, the pro-Iran hacktivist group Handala claimed responsibility for the attack, calling it an “unprecedented blow” and stating that it had wiped more than 200,000 servers, mobile devices, and other systems and exfiltrated 50 terabytes of corporate data.
The incident is the most significant cyberattack to emerge from the wave of Iranian-aligned hacktivist operations that followed the joint U.S.-Israeli military strikes on Iran on February 28.
How the Attack Unfolded
Rather than deploying custom wiper malware, the attackers leveraged a tool already embedded in Stryker’s own infrastructure. According to a source with knowledge of the attack, the perpetrators gained access to Stryker’s Microsoft Intune tenant, a cloud-based endpoint management platform that allows administrators to push software updates, enforce security policies, and issue remote wipe commands to enrolled devices. Once inside, the attackers triggered remote wipe commands across all connected endpoints.
The tactic turned Stryker’s own device management infrastructure into a weapon. Employees who had Microsoft Outlook installed on personal phones reported that their devices were also wiped. The attackers additionally defaced the company’s Microsoft Entra login page to display the Handala logo.
Operational Impact
The scale of the disruption is severe. More than 5,500 employees in Ireland alone, including nearly 4,000 at Stryker’s Cork headquarters, were sent home after internal networks went offline. Cork is Stryker’s largest operational base outside the United States, hosting six manufacturing and research facilities that produce orthopedic implants and surgical technologies used in hospitals globally. A voicemail at Stryker’s U.S. headquarters in Kalamazoo, Michigan, referenced a “building emergency” and employees were forced to communicate via WhatsApp.
The American Hospital Association said it was “actively exchanging information” about the incident but reported no direct U.S. hospital disruptions as of March 11. However, one healthcare professional told Krebs on Security that supply chain complications were already materializing, noting that “pretty much every hospital in the U.S. that performs surgeries uses their supplies.”
Who Is Handala
Handala, also known as the Handala Hack Team, first emerged in late 2023 and primarily targets Israeli organizations. Palo Alto Networks’ Unit 42 has identified the group as one of several personas operated by Void Manticore, an actor affiliated with Iran’s Ministry of Intelligence and Security. The group’s operations have historically included phishing campaigns, data theft, extortion, and destructive attacks using custom wiper malware.
In a Telegram manifesto, Handala stated that the attack on Stryker was retaliation for a February 28 U.S. missile strike on an Iranian school that killed at least 175 people, most of them children. The group labeled Stryker a “Zionist-rooted corporation,” likely referencing the company’s 2019 acquisition of Israeli medical device firm OrthoSpace.
Broader Context
The Stryker attack is part of a broader surge in Iranian-aligned cyber operations since the February 28 strikes. Multiple hacktivist groups, including Cyber Islamic Resistance, Dark Storm Team, and FAD Team, have claimed attacks on critical infrastructure across Israel, Jordan, Kuwait, and the United States. Several groups have claimed access to SCADA and industrial control systems, though many of these claims remain unverified.
The Stryker incident stands out because it demonstrates how cloud-based device management platforms can be turned against the organizations that depend on them. Microsoft Intune’s remote wipe capability, designed to protect corporate data on lost or stolen devices, became the primary attack vector. The incident raises urgent questions about how enterprises secure privileged access to their endpoint management tenants and whether cloud-based MDM platforms need additional safeguards against mass wipe commands.