Stryker Says Investigation Found Malicious File Used in Iran-Linked Attack
Summary
Stryker says investigators identified a non-spreading malicious file used to run commands and hide activity during the attack. The incident disrupted order processing, manufacturing and shipping; the company reports progress restoring systems.
Key points
- Stryker said investigators, working with Palo Alto Networks Unit 42 and others, identified a malicious file used to run commands and hide activity.
- The company said the file could not spread and that its investigation found no malicious activity directed at customers, suppliers, vendors or partners.
- Stryker reported disruption to order processing, manufacturing and shipping, and said it had made progress restoring impacted systems.
- Handala claimed responsibility. The article says the US government has linked the group to Iran’s Ministry of Intelligence and Security.
- The FBI described MOIS malware using a Telegram bot for command-and-control at api.telegram[.]org; the article says that malware is unlikely to be related to the Stryker incident.
Article Details
- Victim Organization
- Stryker
- Incident Type
- Cyberattack; the most likely scenario described was that attackers abused Stryker’s Microsoft Intune instance to wipe systems.
- Operational Impact
- Stryker said order processing, manufacturing, and shipping were disrupted, and that it was restoring impacted systems. Handala claimed it wiped more than 200,000 devices and forced office shutdowns in dozens of countries; those details are claims, not confirmed by Stryker.
- Ransom Or Extortion
- None reported. Stryker said its investigation found no evidence of ransomware being deployed on its systems.
- Claim Status
- claimed
MITRE ATT&CK
T1078 · Valid AccountsThere was some indication that attackers used credentials obtained via infostealer malware to gain access; this was not presented as confirmed.T1485 · Data DestructionSystem wiping was the most likely scenario based on the available evidence, although Handala’s claim to have wiped more than 200,000 devices was not confirmed by Stryker.
Threat Actors
HandalaClaimed responsibility for the Stryker attack and claimed to have wiped more than 200,000 devices. The article says Handala is widely believed to be a hacktivist persona controlled by Iran’s MOIS; the US government officially linked it to MOIS.MOISThe US government officially linked Handala to Iran’s Ministry of Intelligence and Security (MOIS). An FBI alert described attacks allegedly carried out by MOIS threat actors, including Handala.
Products
Microsoft Intunebased on the evidence available to date is that the hackers wiped systems by abusing Stryker’s Microsoft Intune instance, which is used to remotely manage desktop and mobile endpoints and applications within theTelegramStage 1 usually masqueraded as commonly used applications like Pictory, KeePass, and Telegram and contained the binaries for the next stage of malware.
Countries
IranMedical technology giant Stryker has shared an update regarding its investigation into the recent Iran-linked cyberattack, revealing that a malicious file used by the attackers has been identified.United StatesThe US government has officially linked Handala to Iran’s MOIS and has taken down several websites used by the threat actor.