# Iranian APT Identity Weaponization: Void Manticore/Handala Abuses Microsoft Intune MDM for Mass Device Wiping (Stryker Attack)

> Iranian MOIS-linked threat group Void Manticore, operating under the Handala hacktivist persona, compromised Microsoft Intune administrator credentials to issue remote wipe commands across 200,000+ corporate and BYOD devices at Stryker Corporation, representing a paradigm shift from custom wiper malware to identity-based destruction via legitimate cloud management platforms that bypasses traditional endpoint security.

- **Published:** 2026-03-16T12:00:00Z
- **Last reviewed:** 2026-03-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0237
- **ID:** TL-2026-0237
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Void Manticore (Iran)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 11, 2026, the Iranian state-aligned threat group Void Manticore — operating through its Handala hacktivist persona — executed a devastating wiper attack against Stryker Corporation, a Fortune 500 medical technology company with $25 billion in annual revenue and 56,000 employees across 61+ countries. The attack represents a fundamental evolution in Iranian destructive cyber operations: rather than deploying custom wiper malware (Shamoon, ZeroCleare, BiBi), the attackers compromised highly privileged Microsoft Entra ID administrator credentials and weaponized Stryker's own Microsoft Intune MDM platform to issue legitimate remote wipe and factory reset commands to the entire managed device fleet.

The attack simultaneously wiped over 200,000 corporate laptops, servers, and BYOD-enrolled mobile devices across 79 countries. Because the wipe commands originated from authenticated, authorized administrative channels within Microsoft's trusted cloud infrastructure, EDR and antivirus platforms remained entirely blind to the activity — no malicious binary was dropped, no anomalous disk-writing processes were initiated, and no exploit was triggered.

Void Manticore (tracked as Storm-0842/Storm-1084 by Microsoft, Banished Kitten by CrowdStrike, and COBALT MYSTIQUE) operates under the supervision of Iran's Ministry of Intelligence and Security (MOIS), specifically the Internal Security Deputy Counter-Terrorism Division. The group emerged in late 2023 and has been assessed with high confidence by Unit 42, Check Point Research, and Microsoft as a state-directed front rather than an independent hacktivist operation.

The Stryker attack was explicitly motivated by geopolitical retaliation — Handala cited the February 28, 2026 military strike on an Iranian school that killed 175+ people, and framed Stryker as a 'Zionist-rooted corporation' due to its 2019 acquisition of Israeli company OrthoSpace. The attackers claimed to have exfiltrated 50 terabytes of data prior to the destructive phase, though this remains unconfirmed by independent verification.

The healthcare impact was severe: Stryker's LifeNet EKG transmission system was disrupted nationwide in the United States, forcing Maryland EMS to issue emergency manual ECG consultation protocols. 5,000+ employees in Ireland were sent home. Hospitals globally were unable to order surgical supplies through Stryker's systems. Employees who had enrolled personal phones for work access via BYOD also lost all personal data when their devices were factory reset.

This attack establishes a new threat model for enterprises: centralized cloud MDM platforms represent a Tier-0 administrative control plane whose compromise enables global-scale destruction in minutes without deploying any malware. The Iranian threat ecosystem — spanning Void Manticore, APT33/Curious Serpens, APT34/Evasive Serpens, Agrius/Agonizing Serpens, and MuddyWater/Boggy Serpens — has been converging on identity-based attack techniques, with 65% of initial access in recent incidents driven by credential compromise rather than vulnerability exploitation.

Historically, Iranian destructive operations evolved through distinct phases: the 2012 Shamoon attack on Saudi Aramco (MBR wipers using Eldos RawDisk driver), the 2016-2019 'blunt instruments' era (ZeroCleare, Dustman targeting energy/industrial), the 2020-2022 ransomware-as-smokescreen period (Apostle, Fantasy with plausible deniability), and the 2023-2025 hacktivist persona era (BiBi, Hatef, Hamsa cross-platform wipers with Telegram-based psychological operations). The 2026 MDM weaponization represents the latest and most dangerous evolution — identity-based destruction that renders traditional malware detection irrelevant.

Check Point Research documented Handala's broader operational toolkit including custom executable wipers (handala.exe) with MBR overwrite capability, PowerShell-based wipers targeting C:\Users recursively, VeraCrypt disk encryption for drive-level destruction, NetBird mesh networking for C2 tunneling, LSASS memory dumping via rundll32/comsvcs.dll, ADRecon for Active Directory enumeration, and Group Policy modification for domain-wide wiper distribution. The group's operational security has notably declined in 2026, with direct connections from Iranian IP addresses observed and Starlink IP usage following January internet restrictions.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1133 External Remote Services
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1053 Scheduled Task/Job
- T1648 Serverless Execution
- T1037 Boot or Logon Initialization Scripts
- T1098 Account Manipulation
- T1484 Domain or Tenant Policy Modification
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1218 System Binary Proxy Execution
- T1110 Brute Force
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1590 Gather Victim Network Information
- T1021 Remote Services
- T1005 Data from Local System
- T1572 Protocol Tunneling
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1020 Automated Exfiltration
- T1561 Disk Wipe
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1531 Account Access Removal
- T1491 Defacement

## Sources

- [Unit 42: Iranian Cyber Threat Evolution - From MBR Wipers to Identity Weaponization](https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/)
- [Unit 42: Increased Risk of Wiper Attacks from Handala Hack](https://unit42.paloaltonetworks.com/handala-hack-wiper-attacks/)
- [Unit 42: Threat Brief - March 2026 Escalation of Iranian Cyber Risk](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/)
- [Check Point Research: Handala Hack - Unveiling Group's Modus Operandi](https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/)
- [Krebs on Security: Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker](https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/)
- [Splunk: Handala's Wiper - Threat Analysis and Detections](https://www.splunk.com/en_us/blog/security/handalas-wiper-threat-analysis-and-detections.html)
- [CSA: Handala Wiper Attack on Stryker - MOIS Hacktivists Destroy Medical Operations](https://labs.cloudsecurityalliance.org/research/csa-research-note-handala-stryker-mois-wiper-healthcare-2026/)
- [7ai: Stryker Wiper Attack - What Security Teams Need to Know Now](https://7ai.com/stryker-wiper-attack-what-security-teams-need-to-know-now)
- [SecureWorld: Iran-Linked Hacktivist Group Weaponizes Microsoft Intune in Destructive Wiper Attack](https://www.secureworld.io/industry-news/iran-linked-hacktivist-group-weaponizes-microsoft-intune-in-destructive-wiper-attack-on-stryker)
- [Tom's Hardware: Iran Hacking Group Claims Attack on Stryker - 200K+ Devices Wiped](https://www.tomshardware.com/tech-industry/cyber-security/iran-hacking-group-claims-attack-on-med-tech-company-stryker-says-over-200-000-devices-have-been-wiped-clean-and-over-50tb-of-data-extracted)
- [Presidio: When the Wiper Is the Product - Nation-state MDM Attacks](https://www.presidio.com/blogs/when-the-wiper-is-the-product-nation-state-mdm-attacks-and-what-every-enterprise-needs-to-know/)
- [Deepwatch: Handala Cyber Alert - Prevent MDM Wipes and Wiper Attacks](https://www.deepwatch.com/labs/ca-a-26-03-iranian-nexus-handala-hacking-group-escalates-disruptive-operations/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0237