# Handala (Void Manticore/MOIS) Abuses Microsoft Entra ID and Intune for Mass Device Wiping at Stryker Corporation

> Iranian threat actor Handala, assessed as a persona of Void Manticore directed by Iran's Ministry of Intelligence and Security (MOIS), compromised Microsoft Entra ID Global Administrator credentials at Stryker Corporation and weaponized Microsoft Intune's built-in Remote Wipe feature to destroy over 200,000 devices across 79 countries without deploying any malware. The attack disrupted manufacturing, ordering, shipping, and healthcare-adjacent systems globally.

- **Published:** 2026-03-22T12:00:00Z
- **Last reviewed:** 2026-03-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0268
- **ID:** TL-2026-0268
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** MONITORING
- **Actor:** Handala (Iran)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 11, 2026, Iranian-linked threat actor Handala executed a devastating identity control plane attack against Stryker Corporation, one of the world's largest medical device manufacturers (56,000 employees, $25.1B annual revenue). The attack represents a paradigm shift in destructive cyber operations — leveraging legitimate SaaS administration capabilities as a weapon rather than deploying custom malware.

The attack chain began months before the destructive phase, with initial access likely achieved through one of three vectors: adversary-in-the-middle (AiTM) phishing targeting IT administrators to capture authenticated session tokens after MFA completion, VPN credential brute-force with subsequent lateral movement and credential harvesting, or supply chain compromise through a managed service provider with inherited privileged access. Check Point Research documented Handala's broader operational pattern of targeting IT and service providers for credential theft, with hundreds of brute-force attempts against organizational VPN infrastructure observed across multiple campaigns.

Once inside Stryker's Microsoft tenant, the attackers compromised or obtained Global Administrator credentials for Microsoft Entra ID (formerly Azure AD). They created a new Global Administrator account for persistence, ensuring continued access even if the original compromised account was reset. With Global Administrator privileges, the attackers had unrestricted access to Microsoft Intune, the enterprise endpoint management platform managing every enrolled device in Stryker's global fleet.

Between approximately 05:00 and 08:00 UTC on March 11, 2026, the attackers executed Intune's built-in Remote Wipe (factory reset) command against all enrolled devices simultaneously. Over 200,000 systems were rendered inoperable — corporate laptops, mobile devices, virtual servers, and personal BYOD-enrolled phones. The wipe destroyed not only corporate data but personal photos, eSIMs, banking authenticator apps, and locally stored files on BYOD devices.

The operational impact was immediate and global: Stryker's 5,500-person Ireland hub sent all employees home; Maryland paramedics lost LifeNet ECG transmission capability and fell back to radio consultations; surgical supply ordering systems went offline; the company's US headquarters declared a building emergency. WhatsApp became the primary employee communication channel as corporate systems were destroyed.

Handala claimed responsibility the same day, publishing propaganda with the group's signature barefoot boy logo and stating the attack was retaliation for a February 28, 2026 missile strike on an Iranian school that killed at least 175 people, mostly children. The group also claimed exfiltration of data, though specifics remain unconfirmed.

Multiple threat intelligence vendors (Check Point, CrowdStrike, Microsoft, Palo Alto Networks Unit 42) converge on attributing Handala as an operational persona of Void Manticore (also tracked as Storm-0842, Banished Kitten, and Dune), a destructive operations unit within Iran's MOIS Counter-Terrorism Division. Void Manticore historically operated the Homeland Justice persona targeting Albania and the Karma persona for data leaks, with Handala becoming the primary public-facing identity from late 2023 onward.

On March 18, 2026, CISA issued an advisory urging all organizations to harden endpoint management systems, specifically recommending Multi Admin Approval for destructive Intune actions, phishing-resistant MFA on all privileged accounts, role-based access control with least privilege, and Privileged Identity Management for just-in-time access elevation. Microsoft concurrently released updated Intune security best practices.

This incident demonstrates that identity compromise is now the most impactful initial access vector for destructive operations. As Push Security noted in their analysis: the attack proves that operators are creative and pragmatic — if the path of least resistance is a compromised admin credential and a legitimate MDM feature, no serious attacker will deploy custom wiper malware instead.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1199 Trusted Relationship
- T1072 Software Deployment Tools
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1037 Boot or Logon Initialization Scripts
- T1484 Domain or Tenant Policy Modification
- T1685 Disable or Modify Tools
- T1110 Brute Force
- T1003 OS Credential Dumping
- T1557 Adversary-in-the-Middle
- T1087 Account Discovery
- T1021 Remote Services
- T1572 Protocol Tunneling
- T1561 Disk Wipe
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1529 System Shutdown/Reboot

## Sources

- [Sygnia - Lessons from the Stryker Incident: Identity Control Plane Attack](https://www.sygnia.co/threat-reports-and-advisories/identity-control-plane-attack-stryker/)
- [CISA - Urges Endpoint Management System Hardening After Cyberattack](https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-urges-endpoint-management-system-hardening-after-cyberattack-against-us-organization)
- [Check Point Research - Handala Hack: Unveiling Group's Modus Operandi](https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/)
- [Krebs on Security - Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker](https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/)
- [Push Security - Analyzing Iran-nexus TTP Evolution in 2026](https://pushsecurity.com/blog/stryker-handala-report)
- [Stryker Confirms Intune Wipe and Containment Measures](https://techcrunch.com/2026/03/17/stryker-says-its-restoring-systems-after-pro-iran-hackers-wiped-thousands-of-employee-devices/)
- [Lumos - The Stryker Hack: How One Compromised Admin Account Led to 200,000 Wiped Devices](https://www.lumos.com/blog/stryker-hack)
- [SOCRadar - Dark Web Profile: Handala Hack](https://socradar.io/blog/dark-web-profile-handala-hack/)
- [Check Point Research - Iranian MOIS Actors and the Cyber Crime Connection](https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/)
- [BleepingComputer - CISA Warns Businesses to Secure Microsoft Intune After Stryker Breach](https://www.bleepingcomputer.com/news/security/cisa-warns-businesses-to-secure-microsoft-intune-systems-after-stryker-breach/)
- [Cybersecurity Dive - Stryker Attack Raises Concerns About Device Management Tools](https://www.cybersecuritydive.com/news/stryker-attack-device-management-microsoft-iran/814816/)
- [Unit 42 - Handala Attribution Assessment](https://unit42.paloaltonetworks.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0268