Pro-Iran hacktivist group Handala claims responsibility for wiping ~200,000 Stryker Corporation devices across 79 countries, exfiltrating 50TB of data, and defacing Entra ID login portals.

No zero-days. No custom ransomware. Just compromised cloud admin credentials + legitimate Microsoft Intune destructive actions = one of the most disruptive cyberattacks on a medtech giant in 2026.

This isn't endpoint malware. This is Cloud Account Takeover (ATO) → Infrastructure-as-a-Wiper warfare. Your EDR won't save you when the adversary owns your MDM control plane.

Here's the full technical breakdown, MITRE ATT&CK mapping, detection engineering priorities, and a battle-tested hardening checklist.

The Attack Chain: From Phishing to Global Outage

Handala didn't need sophisticated exploits. They followed a disciplined, repeatable playbook

Recon → Phishing → Cloud Account Takeover → MDM Abuse → Data Exfil → Mass Destruction → Influence Ops

Phase 1: Reconnaissance (T1591)

  • OSINT on Stryker's cloud footprint (Entra login URLs, Intune enrollment endpoints)
  • Employee enumeration via LinkedIn + prior leaks for spear-phishing target lists
  • Geopolitical timing: Attack framed around U.S. healthcare supply chains supporting conflict zones

Phase 2: Initial Access (T1566.001/002)

Spear-phishing + smishing → NSIS/AutoIt loaders → Infostealers → SSO credential theft
  • Themed lures posing as software updates/government alerts
  • Commodity infostealers harvesting browser creds, VPN tokens, Entra SSO sessions
  • Known tooling: senvarservice-DC.exe (Telegram/AWS S3/Storj exfiltration)

Phase 3: Privilege Escalation (T1078.004)

Compromised tier-1 → Hybrid identity pivoting → Global Admin / Intune Admin takeover
  • MFA fatigue, password spray, or token replay against Entra ID
  • Pre-positioning: Silent access to Intune/Entra portals for device enumeration

Phase 4: Persistence & Discovery (T1098, T1087.004)

Intune console recon → Device enrollment mapping (~200K endpoints confirmed) 
→ Wipe/Retire capability validation → 50TB data staging

Phase 5: Impact (T1485 + T1565.003)

Dual-pronged destruction:

1. Intune Graph API → Mass Wipe/Retire commands (legitimate MDM actions)
2. Custom Handala wiper → BYOVD via ListOpenedFileDrv_32.sys + OpenFileFinder.dll

Phase 6: Exfiltration (T1020, T1567)

Telegram bot APIs → AWS S3 → Storj buckets → 50TB corporate data harvested

Phase 7: Influence Operations (T1491)

Entra login defacement + Telegram manifestos + "200K devices / 79 countries" propaganda

Why Traditional Defenses Fail

The Stryker attack exposes three critical blind spots:

1. Endpoint-focused security misses cloud control plane compromise
2. "Admin does admin things" behavioral baselines are dangerously permissive  
3. No velocity/scale alerting on legitimate-but-destructive MDM actions

Old mindset: "EDR will catch the malware" New reality: "One Intune Admin console session = game over"

Detection Engineering: What Your SIEM Must Catch

Intune Audit Log Alerts (CRITICAL)

Mass Wipe/Retire Alert: Trigger CRITICAL severity when >5 devices receive Wipe/Retire commands within 10 minutes. KQL example: DeviceManagementScripts | where ActionType == "Wipe"

Non-IT Self-Wipe Alert: HIGH severity for any helpdesk user initiating wipes. KQL: InitiatedByUser != "itadmin@"

Off-Hours Destructive Actions: HIGH severity for destructive actions outside 9–5 local time. KQL: Timestamp !between (startOfDay(1h), endOfDay(1h))

Entra ID Sign-in Alerts (IMMEDIATE)

Global Admin + New ASN: CRITICAL severity for Global Admin sign-ins from Starlink/TOR/new countries.

Intune Admin + New User Agent: CRITICAL severity for Intune Admin using non-browser/programmatic clients.

Service Principal + Wipe Permissions: IMMEDIATE investigation for service principals granted DeviceManagementConfiguration.ReadWrite.All.

Network Hunting Queries

// Handala C2 patterns
NetworkCommunication
| where RemoteUrl contains "api.telegram.org" or RemoteUrl contains "icanhazip.com"

// NSIS/AutoIt loader behaviors
ProcessCreation
| where ProcessCommandLine contains ".nsis" or FileName endswith ".a3x"

Proactive Hardening Checklist (Zero Standing Privileges)

Tier-0 Identity Controls

[ ] No standing Global Admin → PIM JIT + 30min TTL only
[ ] FIDO2 / phishing-resistant MFA for ALL admins  
[ ] Admin workstations → Intune hardened baseline + Endpoint DLP
[ ] Conditional Access → Block legacy auth + high-risk countries
[ ] Separate Emergency Access (break-glass) accounts

MDM Kill-Switch Prevention

[ ] Intune RBAC → Helpdesk cannot wipe (Policy Manager only)
[ ] Wipe/Retire → 2-person approval workflow  
[ ] Daily action volume baseline alerting (5x normal = CRITICAL)
[ ] Separate prod/dev Intune tenants for testing
[ ] Intune remote actions → Geographic + velocity restrictions

Data Protection Layer

[ ] DLP → Block Telegram/pastebin.com from corporate endpoints
[ ] Cloud Access Security Broker → Graph API destructive call monitoring
[ ] Immutable backups → Airgapped + WORM retention
[ ] Data Loss Prevention → Sensitive data → unmanaged endpoints

The CISO Accountability Framework

Ask your identity team these questions TODAY:

1. "Show me yesterday's Intune Wipe/Retire actions by admin"
2. "Who in our org can issue destructive MDM commands right now?"
3. "What's our baseline for normal Intune admin activity?"
4. "Can you show me Global Admin sign-ins from the last 30 days?"

If they hesitate, your control plane is exposed.

Strategic Implications: Beyond Stryker

  1. Healthcare ≠ Critical Infrastructure? Think again. Medtech supply chains = national security priority.
  2. EDR budgets > Identity monitoring budgets? Invert that immediately.
  3. "We have MFA" ≠ "We're identity-secure." MFA fatigue + token replay = owned.
  4. Ransomware response plans ≠ Wiper response plans. Destruction ≠ Encryption.

Action Timeline for Security Leaders

👉 RIGHT NOW (1 hour): Enable ALL Entra/Intune audit logs → SIEM
👉 THIS WEEK: Audit Intune RBAC → Strip excessive permissions
👉 THIS MONTH: Tabletop "MDM Kill Switch" incident response
👉 Q2 PRIORITY: Zero standing privileges across ALL cloud services

The Handala playbook works because most organizations treat cloud admin consoles like helpdesk tools, not nuclear launch codes.

Stryker wasn't "hacked with malware." Stryker was admin-console-pwned.

Your move: Control plane or collateral damage?

Keywords: Handala attack, Stryker breach, Microsoft Intune security, Entra ID compromise, cloud account takeover, MDM wiper attack, MITRE ATT&CK T1485, T1565.003, Zero Trust identity, Intune RBAC hardening

Hashtags: #Cybersecurity #IntuneSecurity #EntraID #CloudSecurity #ZeroTrust #ThreatHunting #MitreATTCK #IdentitySecurity #CISO #SOC #Handala #StrykerBreach