FBI seizes Handala leak sites after Intune mass-wipe attack on Stryker

In March 2026 the FBI seized websites used by Handala, a hacktivist persona linked to Iran, about a week after the group claimed a destructive attack on US medical technology company Stryker. The attackers didn't use custom wiper malware. They took over an administrator account and sent Microsoft Intune's own remote-wipe command to tens of thousands of devices. For anyone running cloud identity and device management, this is the key lesson: your admin console can do as much damage as any wiper if the wrong person controls it.

What happened

Early on 11 March 2026, attackers wiped a large number of Stryker devices through Intune. A source told BleepingComputer that the intruders compromised a Windows domain administrator account, created a new Global Administrator account, and then issued Intune's wipe action. BleepingComputer's source put the number at nearly 80,000 devices. The Record reported more than 200,000 devices across the US, Ireland, India and other countries. Personal phones enrolled in company device management were also wiped. Handala claimed the attack, said it had stolen 50 TB of data, and posted some of it online. Stryker told customers its products were safe and not connected to the incident. The Record also reported knock-on effects for EMS and hospitals in Maryland.

On 18 March, CISA published an alert urging organisations to harden endpoint management systems. Within days, domains used by Handala began showing a seizure banner citing a warrant from the US District Court for the District of Maryland, and their DNS moved to the FBI's seizure name servers. The Record reported that the Justice Department seized four domains (including handala-hack[.]to and handala-redwanted[.]to). It cited a 40-page warrant tying the personas to Iran's Ministry of Intelligence and Security (MOIS) and campaigns going back to the 2022 attacks on Albania. The State Department offered a reward of up to $10 million. Handala said it would rebuild on "resilient infrastructure."

Who is affected

• Stryker, its employees, and healthcare providers who depend on its systems.
• Any organisation using Intune or a similar MDM/UEM (Jamf, Workspace ONE, Google endpoint management) where one privileged identity can send fleet-wide destructive actions.
• Employees with personal devices enrolled under full device management rather than app-level or work-profile management.

What it means for developers and engineering teams

The attack chain was entirely "living off the land". It needed no exploit and no malware on endpoints, just a privilege escalation from on-premises Active Directory to a cloud Global Administrator, followed by legitimate API calls. Many teams have three structural weaknesses that make this possible:

• Synced or bridged admin identities. When an on-prem domain admin can reach cloud tenant admin, compromising AD compromises everything. Cloud-only, separate admin accounts break that path.
• Standing Global Admin rights. A Global Administrator can create more admins, change conditional access and wipe devices. Permanent assignment means the power is always there to steal.
• No second approver for destructive bulk actions. A wipe, retire or delete across thousands of devices should never depend on a single click from a single account.

The same pattern applies to infrastructure automation. Any control plane that can perform irreversible fleet-wide operations, such as Terraform pipelines, Kubernetes cluster-admin, or cloud org admin, is a potential wiper. Treat it with the same safeguards.

What to do now

1. Turn on Intune Multi Admin Approval for device wipe, retire and delete, and for RBAC and script changes. CISA specifically recommends this.
2. Use cloud-only admin accounts that are not synced from on-prem AD, protected by phishing-resistant MFA and Conditional Access, and used only from privileged access workstations.
3. Remove standing Global Admin and use just-in-time elevation through Entra Privileged Identity Management, with approval and alerts on activation.
4. Apply least-privilege Intune RBAC: help-desk roles should not include wipe permissions.
5. Alert on high-risk audit events: new Global Administrator assignments, new admin accounts, and any wipe action affecting more than a handful of devices.
6. Review BYOD enrolment: use app protection or work profiles for personal devices so a corporate wipe can't erase personal data.
7. Rehearse recovery for a mass wipe: device re-provisioning at scale, offline copies of critical runbooks, and out-of-band communications.

Related on TechLogHub

• Authorization
• Authentication
• Infrastructure as Code (IaC)

Sources

• BleepingComputer: FBI seizes Handala data leak site after Stryker cyberattack
• The Record: FBI takes down leak sites tied to Iran's MOIS (20 Mar 2026)
• CISA: Urges endpoint management system hardening after cyberattack against US organization (18 Mar 2026)
• BleepingComputer: CISA warns businesses to secure Microsoft Intune systems after Stryker breach
• Microsoft Learn: Intune Multi Admin Approval