CISA Urges Organizations to Harden Microsoft Intune After Stryker Attack
Summary
CISA urged organizations to harden Microsoft Intune after an attack on Stryker reportedly wiped nearly 80,000 devices. Handala claimed it stole 50 terabytes of data; recommended safeguards include least privilege, MFA and multi-admin approval.
Key points
- CISA urged U.S. organizations to harden endpoint management systems, including Microsoft Intune, after malicious activity affecting Stryker's Microsoft environment.
- The article reports that attackers used a newly created Global Administrator account to issue a remote wipe affecting nearly 80,000 Stryker devices on March 11, 2026.
- Handala claimed it stole 50 terabytes of data before the wipe; the article does not independently verify that claim.
- A source familiar with the incident told BleepingComputer that attackers created the new administrator account after compromising an administrator account.
- CISA and Microsoft recommended least-privilege role-based access control, privileged-access protections and enforced MFA, including through Microsoft Entra ID.
- They also recommended requiring multi-admin approval for sensitive actions such as device wipes, application updates and role changes.
- The article says Handala has been linked to Iran's Ministry of Intelligence and Security and is known for data-wiping operations and stealing and leaking data.
Article Details
- Event Type
- Cyberattack exploiting Microsoft Intune for data theft and mass device wiping
- Impact
- Stryker’s Microsoft environment was affected, with nearly 80,000 devices reportedly wiped. Handala claimed it stole 50 terabytes of data before the wipe; that theft claim is unverified in the supplied article.
MITRE ATT&CK
T1136.003 · Cloud AccountA source familiar with the incident told BleepingComputer that the attackers created a new Global Administrator account after compromising an administrator account.T1485 · Data DestructionThe attackers reportedly used Intune’s built-in wipe command to wipe nearly 80,000 devices.
Threat Actors
HamsaIdentified by the article as another name for Handala, which claimed responsibility for the Stryker attack.HandalaClaimed responsibility for the Stryker attack. The article says the group emerged in 2023, targets Israeli organizations, and is linked to Iran’s MOIS.Handala Hack TeamIdentified by the article as another name for Handala, which claimed responsibility for the Stryker attack.HatefIdentified by the article as another name for Handala, which claimed responsibility for the Stryker attack.
Vendors
Products
Microsoft Entra IDKey defenses include least-privilege RBAC, Microsoft Entra ID controls, mandatory MFA, and multi-admin approval for sensitive actions.Microsoft Intuneorganizations to harden Microsoft Intune after a March 11 attack exploited the platform to steal data and remotely wipe nearly 80,000 Stryker devices.