Forest Global Training Partners

Cyber Risks · Cisco Talos

Update, March 13: Talos on the developing situation in the Middle East

Summary: Cisco Talos assesses that the March 11, 2026 cyber attack on medical equipment manufacturer Stryker was likely an opportunistic compromise, with the Iran-linked Handala group claiming it deployed a wiper to erase data from more than 200,000 systems and exfiltrated 50 terabytes of data, claims not officially verified. Talos says the attack was almost certainly executed by compromising high-level administrative accounts, likely through Stryker's Microsoft Intune management console where the native remote wipe feature was reportedly weaponized, based on hundreds of leaked Stryker credentials found on the dark web.

What you should know: Handala, assessed as a persona operated by the Iranian MOIS-affiliated actor Void Manticore, reportedly turned an administrative console your IT team uses every day into the destructive tool itself, wiping devices without traditional wiper malware. Talos notes disruptive attacks in a target country can unintentionally spill over to organizations elsewhere, and that hundreds of attacks have been claimed since the conflict began.

Read the original at Cisco Talos ↗

Topics
Malware
Related