When Admin Tools Become Cyberweapons: The Intune Backdoor
Iran-linked threat actors attacked medical device manufacturer Stryker on March 11, starting shortly after midnight and causing outages across the organization. What makes this attack distinct isn't the scale—the group claimed more than 200,000 systems, servers, and mobile devices were wiped and 50 terabytes of data were exfiltrated—but the method. No ransomware or malware was used; instead, the attack was a data theft and wiping attack that affected Stryker's Microsoft programs, including the wiping of Windows-based devices such as mobile phones and laptops.
This represents a dangerous inflection point in critical infrastructure attacks. Palo Alto researchers noted that recent Handala activities include a noticeable focus on supply-chain footholds, followed by 'proof' posts to amplify credibility and intimidate targets. But the real threat lies beneath the surface: the gap between identity authentication and identity governance that every enterprise with Microsoft 365 now faces.
How Device Management Became a Doomsday Button
Security researcher Kevin Beaumont suggests that Handala actors gained access to Stryker's Active Directory services and used the Microsoft endpoint management tool Intune to remotely wipe Microsoft devices, including devices used by employees managed under its bring-your-own-device policy. Intune isn't a security flaw—it's a legitimate tool. The remote wipe feature is one of Intune's core functions: from there, attackers triggered the wipe for some or all enrolled devices, a feature commonly used when a device needs to be retired, repurposed, reset for troubleshooting, or securely erased if lost or stolen.
The attack exposes a critical governance failure: once threat actors obtain valid admin credentials through phishing or compromised supplier access, they don't need zero-days. The breach likely occurred due to privilege escalation from a lack of governance controls or a phishing attack that obtained admin credentials. They simply inherit the organization's own authorized tools.
This isn't a new vulnerability. It's a process vulnerability—and that's exponentially harder to patch.
The Supply Chain Domino Effect
The attack affected order processing, manufacturing, and shipments, but no patient-related services or connected medical products were affected; Stryker is prioritizing restoration of systems that directly support customers, ordering, and shipping. Yet disruptions were immediate. One healthcare professional at a major university medical system in the United States told KrebsOnSecurity they are currently unable to order surgical supplies that they normally source through Stryker, describing it as a real-world supply chain attack.
Delays in production ripple through the supply chain with delays to sterilisation services and delivery of components; consumables supply will be hit quickest, potentially forcing physicians to switch brands; the hack could also impact Stryker's inventory control capabilities, meaning it may hinder the company's ability to forecast how long it can sustain supply for.
The timing amplifies the damage. Concerns over potential supply chain issues—particularly with generic drug prescriptions, nearly half of which are imported from India—have been sprouting up due to the war's closure of the Strait of Hormuz. Cyber conflict now mirrors geopolitical tensions, where disruption is used as a signal of reach and capability, not just immediate impact; this cyberattack is direct retaliation tied to the broader conflict with Iran.
The Governance Gap: Why Intune Was the Weak Link
The fundamental issue isn't Intune—it's unmonitored admin access. Here's the attack chain:
- Initial Access: Phishing or third-party compromise yields valid admin credentials
- Lateral Movement: Attacker gains Active Directory access without triggering anomaly detection
- Execution: Legitimate Intune remote wipe commands execute at scale across 200,000+ devices
- Detection: By the time defenders notice, devices are already wiped
The data breaches reported in February 2026 reveal that exposure did not come from sophisticated attacks but from unmonitored peripheral systems, third-party vendor access gaps, credential reuse, and limited visibility into where sensitive data resided. Stryker's incident amplifies this pattern across critical infrastructure.
CISO teams at enterprises globally now face an urgent question: If an attacker compromises an admin account, can they wipe 200,000 devices? The answer for most organizations using Microsoft Endpoint Management is yes—unless they've implemented strict MFA enforcement, admin approval workflows, and anomaly detection on Intune actions. MS 365 users should probably be fine as long as they're keeping an eye on their device management.
What's Next: The Identity Governance Reckoning
US intelligence officials have warned about the possibility of Tehran-linked hackers retaliating for the US and Israeli bombing of Iran that began last month. Handala isn't alone. Other state-sponsored groups will replicate this attack because it works: identity compromise + device management = mass disruption, no malware required.
The cyberattack targeted Cegedim Santé, a healthcare software vendor used by around 3,800 doctors in France, with leaked records including personal data such as full names, gender, dates of birth, phone numbers, residential addresses and email IDs; in some cases, highly sensitive health information was exposed, just weeks after another major breach involving the French Ministry of Finance. The pattern is clear: healthcare and government are targets, and identity access is the vector.
The immediate defense isn't architectural. It's procedural. Organizations need:
- Privileged Access Management (PAM) with session recording for all Intune administrative actions
- Real-time alerting on mass device wipe commands (anything > 100 devices simultaneously)
- MFA enforcement for admin accounts, with conditional access policies that block wipes from unusual locations or times
- Supply chain visibility into which systems have device management privileges across vendors
Key Takeaways
The Stryker attack used legitimate Microsoft Intune device management to remotely wipe corporate devices after attackers gained Active Directory access. No zero-day, no malware—just stolen credentials plus inherited admin privileges.
The attackers claim to have wiped more than 200,000 servers, mobile devices, and other systems, forcing Stryker to shut down offices in 79 countries, and allegedly stole 50TB of data. Critical infrastructure disruption at scale using legitimate tools.
Healthcare providers immediately felt the impact, unable to order surgical supplies, revealing that the attack is a real-world supply chain attack affecting hospital operations.
The vulnerability isn't technical; it's governance. Most organizations haven't implemented anomaly detection on privileged device management actions, making them vulnerable to the same attack.
Cyber conflict now mirrors geopolitical tensions as disruption is used as a signal of reach and capability; this attack is direct retaliation tied to the broader conflict with Iran. State-sponsored groups will replicate this technique against other critical infrastructure sectors.
References
Iran Linked Hacking Group Wipes Data of U.S. Medical Device Manufacturer — HIPAA Journal, March 2026
Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker — Krebs on Security, March 2026
MedTech Giant Stryker Crippled by Iran-Linked Hacker Attack — SecurityWeek, March 2026
Suspected Iran-linked cyberattack hits medical technology giant Stryker — Industrial Cyber, March 2026
Cyberattack against Stryker highlights potential impacts of Iran war on healthcare industry — Healthcare Brew, March 2026
Iran appears to have conducted a significant cyberattack against a U.S. company — NBC News, March 2026
Stryker: Pro-Iran hackers claim cyberattack on major US medical device maker — CNN Politics, March 2026
Top Data Breaches of February 2026 — Security Boulevard, March 2026
Stryker still recovering from Iran-linked cyberattack — Medical Device Network, March 2026
The Week in Breach News: March 11, 2026 — Kaseya, March 2026
