Handala Claims Stryker Wipe as Armadin and Cylake Raise $235 Million
Summary
Stryker confirmed global Microsoft-environment disruption after Handala claimed wiping 200,000+ devices and exfiltrating 50TB; reporting points to Intune misuse. The roundup also covers $235M in security startup funding, AI security tools and shrinking exploit timelines
Key points
- Stryker confirmed global disruption to its Microsoft environment and said the incident appeared contained, with no indication of ransomware.
- Handala claimed it wiped more than 200,000 Stryker devices and exfiltrated 50TB. Reporting cited in the article says attackers appear to have used Microsoft Intune to issue remote wipe commands.
- Palo Alto Networks links Handala to Void Manticore, an actor affiliated with Iran’s Ministry of Intelligence and Security.
- Kevin Mandia’s Armadin raised $189.9 million, while Nir Zuk’s Cylake launched with $45 million in seed funding; both companies are building AI-driven security platforms.
- OpenAI is acquiring Promptfoo, whose tools evaluate AI applications for issues including prompt injection, data leakage and jailbreaks.
- The Zero Day Clock project reports median time-to-exploit fell from 771 days to 6.36 days over five years; the article says organizations take an average of 20 days to test and deploy patches.
Article Details
- Event Type
- Destructive cyberattack and data-exfiltration incident targeting Stryker
- Impact
- Handala claimed it wiped more than 200,000 devices and exfiltrated 50 TB of data. Stryker confirmed a global disruption to its Microsoft environment and said the incident was contained, with no indication of ransomware, but gave no restoration timeline. The article reports office closures across 79 countries and operational disruption; employees also reported that personal devices enrolled for work access were wiped.
MITRE ATT&CK
Threat Actors
HandalaClaimed responsibility for wiping Stryker devices and exfiltrating data. The article says the attackers appear to have used Stryker's Microsoft Intune environment to issue remote wipe commands; attribution and the claimed scale of the attack are not independently established in the article.Void ManticorePalo Alto Networks links Handala to Void Manticore, which the article describes as affiliated with Iran's Ministry of Intelligence and Security. This is a reported attribution.