TL;DR — The Scope of Destruction
Two separate attacks in 48 hours: Stryker (world's largest medical device company) and Intuitive Surgical (da Vinci robots) were both compromised between March 11–13, 2026. Handala used Microsoft Intune as a global kill switch — no malware required.
Two Giants Brought Down in One Week
At 3:30 AM EST, Handala triggered simultaneous factory resets on 200,000+ corporate devices across 79 countries. No malware deployed — they hijacked Stryker's own Microsoft Intune MDM platform and used it as a global kill switch.
The maker of da Vinci surgical robots disclosed that attackers used a phishing email to steal employee credentials, accessed internal admin systems, and exfiltrated customer contact data and employee corporate records.
Critical note: Neither company's medical devices were operationally affected — da Vinci robots kept operating, Stryker implants weren't remotely controlled. But the business damage was catastrophic, and the attack methods exposed vulnerabilities affecting virtually every enterprise using MDM platforms.
Stryker: How Handala Used Intune as a Weapon
This attack is technically unprecedented. The 4-step chain required zero malware, zero CVEs, and was invisible to traditional endpoint detection tools.
Handala obtained credentials for a Stryker Intune administrator account. Likely via phishing, credential stuffing against a leaked database, or compromise of a privileged Entra ID (Azure AD) account.
With admin access, attackers gained full visibility into Stryker's device fleet — 200,000+ endpoints across 79 countries: laptops, workstations, mobile phones, and enrolled servers.
While preparing the wipe, Handala exfiltrated 50TB of corporate data first — ensuring they had the intelligence before destroying access.
Factory reset commands issued through Intune to ALL enrolled devices simultaneously. No malware. No exploits. Legitimate MDM functionality, weaponized at global scale.
Real-World Impact
Who is Handala?
Handala (also known as Handala Hack Team or Void Manticore) is an Iran-linked hacktivist group that historically targets entities perceived as adversaries of Iran — particularly U.S. and Israeli companies. Security researchers at Securonix have tied the group to Iranian state interests. The Stryker attack is characterized as geopolitically motivated retaliation amid heightened Middle East tensions in early 2026.
Intuitive Surgical: The Classic Phishing Playbook
The Intuitive Surgical breach reads like a textbook credential phishing case — deceptively simple, devastatingly effective.
An Intuitive employee received a phishing email convincing enough to capture their corporate credentials. The attacker then accessed Intuitive's internal administrative network, exfiltrating:
Two major medtech companies breached within 48 hours raises serious questions. Were they coordinated? Were attackers probing the sector opportunistically after seeing Stryker's exposure? Cybersecurity researchers are actively investigating potential connections between the two incidents.
The MDM Attack Vector: A Wake-Up Call
If your company manages devices with Microsoft Intune, SCCM, Jamf, or any MDM platform, this section is your threat model. A compromised MDM admin account is effectively a god-mode key to your entire device fleet.
With it, an attacker can:
A single admin command destroys your entire device fleet. No malware needed.
CRITICALDeploy ransomware, spyware, or keyloggers to every employee at once.
CRITICALComplete map of your infrastructure — hardware, software, users, locations.
HIGHModify compliance policies to disable AV, EDR, disk encryption at scale.
HIGHRevoke certificates to prevent legitimate administrators from regaining control.
HIGHIntune admin often implies access to email, SharePoint, Teams via Entra ID.
CRITICAL“A New Threat Category” — Security Affairs
The Stryker attack represents the first confirmed large-scale use of a legitimate MDM platform as a destructive weapon — without deploying a single line of malicious code. Traditional endpoint detection tools see Intune commands as legitimate. There is nothing to flag. No AV signature. No behavioral anomaly. Just routine MDM operations at a scale that destroys an entire enterprise overnight.
Attack Timeline
Geographic Scope: 79 Countries Hit
Affected Operations by Region
Why Healthcare & Medtech Are Under Siege
These attacks don't exist in a vacuum. Healthcare and medtech have become priority targets for nation-states and cybercriminals for converging reasons:
Healthcare records sell for $408/record on black markets — 10× the value of financial records. Medtech companies hold both patient data and critical operational IP.
Nation-states (Iran, China, Russia, North Korea) view medtech as high-impact targets: disrupting supply chains creates civilian pressure; stealing device IP enables strategic technology transfer.
Medtech companies prioritized device safety certifications over IT security. Many run legacy OT systems alongside modern cloud infrastructure — complex, difficult-to-defend attack surfaces.
How to Protect Your Organization
Whether you're a medtech enterprise or any company running MDM platforms, these two attacks define your threat model for 2026. Immediate actions:
MDM admin accounts must use just-in-time (JIT) access — admins request elevated permissions only when needed, with approval workflows and automatic expiration. Zero persistent admin sessions.
Flag ANY Intune admin sign-in. Mass device operations (>10 devices in a short window) should require manual approval before execution.
Maintain 2–3 emergency admin accounts completely offline with credentials in physical secure storage — not accessible via the same cloud infrastructure that could be compromised.
Restrict Intune admin portal access to specific IP ranges, managed devices, and MFA-required sessions. Block access from unrecognized geographies.
Standard MFA (SMS, TOTP) can be bypassed by sophisticated phishing. Hardware keys (YubiKey, Passkeys) are phishing-resistant by design — mandatory for all privileged accounts.
Maintain offline, immutable backups of critical configurations and systems. A wiper attack only achieves its goal if recovery is impossible. Know your RTO before you need it.
Export and version-control your Intune policies and device configurations regularly. Recovery from a mass wipe requires clean baselines.
If third-party vendors have MDM access to your environment, you've extended your attack surface to their security posture. Audit and restrict it.
Simulate a mass wipe event. Do you know how long it takes to restore 1,000 devices? 10,000? Know this number before you need it. Stryker is still rebuilding its fleet weeks later.
Sources & References
¿Tu empresa usa Microsoft Intune, Jamf, o cualquier MDM?
El ataque a Stryker redefinió el riesgo empresarial. Sable puede auditar tu postura de seguridad MDM y accesos privilegiados antes de que Handala lo haga primero.
Este análisis es para propósitos de concientización y defensa. Toda la información está basada en divulgaciones públicas, reportes de organizaciones de seguridad, y fuentes de medios verificadas.