Federal Agencies Urge Microsoft Intune Hardening After Iran-Linked Handala Group Devastates Medical Giant Stryker

United States federal cybersecurity agencies are urgently warning organizations to lock down their endpoint management systems following a catastrophic, Iran-connected cyberattack on the Michigan-based medical technology giant Stryker.

In a joint advisory released Wednesday night, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) confirmed their active response to the March 11 breach. The sophisticated intrusion bypassed traditional malware deployments entirely. Instead, the pro-Iranian hacking collective known as Handala allegedly obtained compromised administrator credentials—likely harvested via infostealer malware—to hijack Stryker’s legitimate Microsoft Intune environment. Once inside the cloud-based endpoint management system, the threat actors weaponized its built-in remote-wipe capabilities. This allowed them to execute a global factory reset that erased data across an estimated 80,000 to 200,000 corporate servers, laptops, and mobile devices spanning 79 countries.

The fallout from the Stryker incident has highlighted the profound, frequently overlooked risks associated with "Bring Your Own Device" corporate policies. Because the destructive commands were issued through trusted Intune infrastructure, security software was entirely blind to the attack. As a result, the wipe commands cascaded to personal devices enrolled in the company's network. Displaced Stryker employees across the United States, Ireland, Australia, and India took to social media to report that their personal phones had been factory reset in real-time, resulting in the irrecoverable loss of personal photos, eSIM configurations, and essential two-factor authentication applications. With its workforce temporarily paralyzed and critical global manufacturing operations severely disrupted, the Fortune 500 company has spent over a week struggling to restore systems and maintain business continuity.

To prevent similar devastation, CISA is urging all Microsoft Intune customers to immediately implement hardened configurations. The federal guidance emphasizes a strict least-privilege approach, advising IT teams to utilize role-based access controls that assign only the absolute minimum permissions necessary for daily operations. Furthermore, the agencies mandate the use of phishing-resistant multi-factor authentication and Microsoft Entra ID to block unauthorized access to privileged portals. Crucially, CISA strongly recommends that organizations implement "Multi Admin Approval" policies. This vital security checkpoint requires a second administrative account to authorize any sensitive or high-impact actions—such as enterprise-wide device wiping—effectively eliminating the single point of failure that Handala exploited during the Stryker breach.

The cyberattack and subsequent federal response mark a significant escalation in geopolitical cyber warfare tied to the ongoing conflict in the Middle East. As CISA coordinates with federal partners to identify further mitigation actions, the United States government has taken aggressive steps to dismantle the threat actors' digital infrastructure. This week, the FBI successfully seized multiple domains operated by Handala, including handala-hack.to and handala-redwanted.to. Visitors to the sites are now met with a federal seizure banner stating that the domains were used to conduct and facilitate malicious cyber activities on behalf of Iran's Ministry of Intelligence and Security. The FBI noted that the seizure aims to disrupt ongoing operations and prevent further exploitation of American entities. This coordinated digital takedown coincides with severe kinetic escalations in the region, coming shortly after Israeli officials claimed that several key Iranian leaders orchestrating Handala's operations were killed in recent targeted airstrikes.