# Handala Hack (Void Manticore) Wiper Campaign via Microsoft Intune Abuse — Stryker Attack

> Iran-linked threat actor Handala Hack (Void Manticore / Storm-0842), operating under Iran's Ministry of Intelligence and Security (MOIS), is conducting escalated destructive wiper attacks against Israeli and US organizations. The group compromises administrative credentials via phishing and brute-force, then abuses Microsoft Intune MDM to mass-wipe enrolled devices. On March 11, 2026, the group claimed a devastating attack on Stryker Corporation, wiping over 200,000 devices across 79 countries.

- **Published:** 2026-03-12T12:00:00Z
- **Last reviewed:** 2026-03-12T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0220
- **ID:** TL-2026-0220
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** VOID MANTICORE (Iran)
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Handala Hack is an online persona operated by Void Manticore (also tracked as Storm-0842, COBALT MYSTIQUE, Red Sandstorm, and Banished Kitten), an Iranian state-sponsored threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS), specifically the Internal Security Deputy and Counter-Terrorism Division.

The group first emerged in late 2023 and has since conducted multiple destructive campaigns against Israeli organizations, Albanian government infrastructure, and most recently US corporations. Void Manticore maintains several hacktivist personas including Handala Hack (targeting Israel), Karma (targeting Israel), and Homeland Justice (targeting Albania).

The attack chain begins with credential compromise through phishing campaigns and brute-force attacks against VPN infrastructure. Attackers operate from commercial VPN nodes and Starlink IP ranges, conducting hundreds of login attempts. Once initial access is obtained, the group establishes persistent access through compromised IT service providers and supply chain relationships, maintaining dwell times of several months before destructive operations.

Lateral movement is conducted manually via Remote Desktop Protocol (RDP) from at least five distinct attacker-controlled machines. The group deploys NetBird, a zero-trust mesh networking tool, for persistent command and control. Credential harvesting is performed through LSASS process dumping using rundll32.exe and comsvcs.dll, registry hive exporting (HKLM, SAM, SECURITY), and Active Directory reconnaissance using ADRecon (deployed as dra.ps1).

The destructive phase employs multiple wiper mechanisms: the custom Handala Wiper (handala.exe) distributed via Group Policy logon scripts, a PowerShell-based wiper that enumerates and deletes user directories while deploying propaganda imagery, VeraCrypt disk encryption as a destruction mechanism, and direct deletion of virtual machines from hypervisors.

In the March 11, 2026 attack on Stryker Corporation, a $25 billion medical technology company, the attackers introduced a novel technique: abusing Microsoft Intune, Stryker's cloud-based Mobile Device Management (MDM) platform. After compromising Global Administrator credentials for the Intune environment, the attackers issued mass Remote Wipe commands to all enrolled devices simultaneously. This affected over 200,000 systems including servers, workstations, and mobile devices across 79 countries, idling approximately 56,000 employees. Personal devices enrolled under BYOD policies were also factory-reset, destroying personal data, eSIMs, and 2FA configurations. Handala claimed to have exfiltrated 50 terabytes of data.

Israel's National Cyber Directorate issued a warning on March 6, 2026, alerting that attackers had gained access to corporate networks and were deleting servers. The Stryker attack represents the first confirmed major cyber disruption of a US corporation since joint US-Israeli military strikes on Iran commenced on February 28, 2026.

Notably, a decline in the group's operational security was observed post-January 2026, when Iran experienced an internet shutdown. Operators transitioned to Starlink IP ranges and began connecting directly from Iranian IP addresses, deviating from their historical use of commercial VPN egress nodes.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1133 External Remote Services
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1072 Software Deployment Tools
- T1053 Scheduled Task/Job
- T1047 Windows Management Instrumentation
- T1037 Boot or Logon Initialization Scripts
- T1505 Server Software Component
- T1484 Domain or Tenant Policy Modification
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1110 Brute Force
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction
- T1561 Disk Wipe
- T1486 Data Encrypted for Impact
- T1531 Account Access Removal
- T1529 System Shutdown/Reboot
- T1490 Inhibit System Recovery

## Sources

- [Unit 42 - Insights Into the Increased Risk of Wiper Attacks by Handala Hack](https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks/)
- [Check Point Research - Handala Hack: Unveiling Group's Modus Operandi](https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/)
- [Krebs on Security - Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker](https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/)
- [BleepingComputer - Medtech Giant Stryker Offline After Iran-Linked Wiper Malware Attack](https://www.bleepingcomputer.com/news/security/medtech-giant-stryker-offline-after-iran-linked-wiper-malware-attack/)
- [Check Point Research - Bad Karma, No Justice: Void Manticore Destructive Activities in Israel](https://research.checkpoint.com/2024/bad-karma-no-justice-void-manticore-destructive-activities-in-israel/)
- [Zetter Zero Day - Iranian Hacktivists Strike Medical Device Maker Stryker in Severe Attack](https://www.zetter-zeroday.com/iranian-hacktivists-strike-medical-device-maker-stryker-in-severe-attack-that-wiped-systems/)
- [NBC News - Iran Appears to Have Conducted Significant Cyberattack Against US Company](https://www.nbcnews.com/world/iran/iran-appears-conducted-significant-cyberattack-us-company-first-war-st-rcna263084)
- [Cybersecurity Dive - US Entities Face Heightened Cyber Risk Related to Iran War](https://www.cybersecuritydive.com/news/us-entities-cyber-risk-iran-war/814313/)
- [Nextgov/FCW - Suspected Pro-Iran Hacker Group Tied to Stryker Cyberattack](https://www.nextgov.com/cybersecurity/2026/03/suspected-pro-iran-hacker-group-tied-stryker-cyberattack/412050/)
- [SOCRadar - Dark Web Profile: Storm-842 (Void Manticore)](https://socradar.io/blog/dark-web-profile-storm-842-void-manticore/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0220