- Updated: March 12, 2026
- 7 min read
Iran‑Backed Handala Group Launches Wiper Attack on Medical‑Tech Giant Stryker
Iran‑backed hackers have launched a destructive wiper attack against medical‑technology giant Stryker, erasing data on more than 200,000 systems worldwide and crippling the company’s operations. Read the full Krebs on Security report.
What Happened at Stryker?
On March 10, 2026, Stryker – a Michigan‑based leader in surgical equipment and medical devices – reported a massive outage affecting its offices in 79 countries. The disruption began with a voicemail at the company’s U.S. headquarters announcing a “building emergency,” followed by reports from the Irish hub that more than 5,000 employees were sent home as their laptops, tablets, and even Outlook mobile apps displayed a defaced login screen bearing the Handala logo.
According to the Krebs investigation, the attackers used Microsoft Intune – a legitimate cloud‑based device‑management service – to issue a remote‑wipe command that overwrote data on every enrolled endpoint. The result: more than 200,000 devices, servers, and mobile phones were rendered inoperable within hours.
Timeline and Immediate Impact
- 08:30 UTC – Stryker’s Irish headquarters receives a suspicious Intune command.
- 09:15 UTC – Employees report locked screens and “device wiped” messages on personal phones.
- 10:00 UTC – Stryker’s internal IT hotline redirects callers to a voicemail stating a building emergency.
- 11:30 UTC – The company confirms a coordinated wiper attack and begins public communication.
- 13:00 UTC – Hospitals that rely on Stryker’s supply chain report delays in receiving surgical instruments.
The fallout extended beyond IT. Surgeons in a major U.S. university hospital were forced to postpone elective procedures because the ordering portal, hosted on Stryker’s cloud platform, was offline. The American Hospital Association (AHA) noted that while no immediate patient‑care crisis had been confirmed, the risk of a prolonged supply‑chain disruption was “significant.”
How the Wiper Operated
The Handala group, also known as the Handala Hack Team, claimed responsibility in a manifesto posted on Telegram. Their statement linked the attack to a retaliatory motive for a U.S. missile strike on an Iranian school earlier that month. Technically, the wiper leveraged two key vectors:
- Abuse of Microsoft Intune: By compromising an administrator’s credentials, the attackers accessed the Intune console and broadcast a “remote wipe” command to every device enrolled under Stryker’s management profile.
- Payload delivery via PowerShell: The remote‑wipe command invoked a PowerShell script that overwrote the file system with random data, effectively destroying any recoverable information.
This approach differs from classic ransomware because the goal is not extortion but total data destruction. The attackers deliberately avoided encrypting files; instead, they rendered devices unusable, forcing a complete rebuild of the IT environment.
Who Is Handala and What Are Their Tactics?
Handala emerged in late 2023 and is believed to be an online persona operated by Iran’s Ministry of Intelligence and Security (MOIS). Palo Alto Networks’ Unit 42 links the group to the “Void Manticore” actor, noting a pattern of “quick‑and‑dirty” attacks that target supply‑chain footholds such as IT service providers, cloud consoles, and third‑party management tools.
The group’s manifesto framed Stryker as a “Zionist‑rooted corporation,” referencing the 2019 acquisition of Israeli firm OrthoSpace. Their messaging strategy—publicly posting a manifesto on Telegram while simultaneously executing a destructive payload—serves two purposes: it amplifies geopolitical propaganda and creates a “proof of capability” that can be leveraged for future extortion or espionage campaigns.
Why the Attack Matters for the Medical‑Technology Industry
Stryker is not just a device manufacturer; it is a critical node in a global supply chain that delivers implants, surgical tools, and digital health platforms to hospitals worldwide. The wiper attack exposed several systemic vulnerabilities:
- Dependency on cloud‑based device management: While services like Intune improve operational efficiency, they also become high‑value attack surfaces when credentials are compromised.
- Insufficient segmentation: The ability to issue a wipe across all regions indicates a lack of network segmentation and overly broad administrative privileges.
- Limited incident‑response automation: Stryker’s initial response relied on manual phone calls and voicemail, delaying containment.
For healthcare providers, the immediate risk is a disruption in the procurement of essential surgical supplies. In the longer term, the incident raises questions about the resilience of medical‑device software updates, remote monitoring solutions, and the growing trend of “software‑as‑a‑medical‑device” (SaMD) platforms that rely on continuous connectivity.
How Organizations Can Defend Against Similar Wiper Attacks
Immediate Response Actions
- Isolate compromised accounts: Revoke all active tokens for cloud‑based management consoles (e.g., Intune, Azure AD) and force password resets.
- Activate backup restoration: Verify that recent, immutable backups exist for critical systems and begin a staged recovery.
- Engage forensic teams: Conduct a rapid forensic analysis to identify the initial foothold and any lateral movement.
- Communicate transparently: Notify affected partners, hospitals, and regulators promptly to manage expectations and compliance obligations.
Long‑Term Hardening Strategies
- Zero‑trust architecture: Enforce least‑privilege access for all cloud consoles and require multi‑factor authentication (MFA) for every administrative action.
- Segmentation of device‑management scopes: Separate critical production devices from test or employee‑owned devices within Intune or similar platforms.
- Immutable backup solutions: Store backups in write‑once, read‑many (WORM) storage to prevent tampering.
- Automated detection and response: Deploy security‑orchestration tools that can automatically quarantine devices when anomalous remote‑wipe commands are detected.
- Regular red‑team exercises: Simulate wiper scenarios to validate detection, containment, and recovery processes.
Leveraging UBOS for Proactive Cyber Resilience
The challenges highlighted by the Stryker incident are precisely the problems UBOS was built to solve. By combining a low‑code development environment with AI‑driven automation, UBOS enables security teams to build, test, and deploy protective workflows at speed.
UBOS Platform Overview
The UBOS platform overview showcases a unified console where you can orchestrate device‑management policies, integrate threat‑intelligence feeds, and trigger automated remediation actions—all without writing extensive code.
AI‑Powered Security Automation
Using the Workflow automation studio, security analysts can create a “remote‑wipe detection” workflow that:
- Monitors Intune and Azure AD logs for mass‑wipe commands.
- Automatically revokes the offending admin token.
- Sends real‑time alerts to Slack, Teams, or email.
- Initiates a predefined backup‑restore playbook.
The platform also integrates with OpenAI ChatGPT integration to provide natural‑language query capabilities, allowing analysts to ask “Why did the wipe command fire at 09:15 UTC?” and receive an AI‑generated forensic summary instantly.
Accelerating Adoption with Templates
For teams that need a fast start, UBOS offers pre‑built UBOS templates for quick start. The “AI SEO Analyzer” template, for example, can be repurposed to scan configuration files for insecure defaults, while the “AI Chatbot template” can be adapted to provide a self‑service security help desk for employees.
Scalable for Any Organization
Whether you are a startup building its first security stack, an SMB looking to automate compliance, or an enterprise seeking a unified AI‑driven defense, UBOS provides the flexibility to scale. The UBOS pricing plans are transparent, with a free tier that lets you prototype a wiper‑detection workflow before committing to production.
Moreover, the UBOS partner program enables managed‑service providers to embed these capabilities into their own offerings, extending protection to a broader client base.
Conclusion
The Stryker wiper attack is a stark reminder that even the most reputable medical‑technology firms are vulnerable when cloud‑based management tools are misused. By understanding the tactics of groups like Handala, implementing robust zero‑trust controls, and leveraging AI‑driven automation platforms such as UBOS, organizations can dramatically reduce the risk of a catastrophic data‑wipe.
Stay ahead of emerging threats—explore the UBOS homepage today and start building resilient, AI‑enhanced security workflows that protect your critical healthcare operations.