The Stryker Cyberattack: When your own Management Tools are Turned Against You

Australia, Mar 18, 2026

The Stryker Cyberattack: When your own Management Tools are Turned Against You

The recent "Handala" wiper attack against the global MedTech giant Stryker Corporation has sent shockwaves through the global IT community. This wasn't a traditional malware infection; instead, it was a sophisticated "living-off-the-land" attack where legitimate administrative tools, reportedly Microsoft Intune - were weaponised to remotely wipe, effectively factory-resetting, over 200,000 Windows and Mobile devices across 79 countries.

What the "Stryker" Attack Teaches Us

As highlighted by recent analysis from ThreatHunter.ai and ThreatLocker, this was not a sophisticated exploit of a software vulnerability. It was an abuse of legitimate functionality. When an attacker gains Global Admin or Intune Administrator privileges, they don't need a "zero-day" exploit; they have the keys to the kingdom.
This incident proves that traditional perimeter security is no longer enough. If your endpoint management console is protected only by a single set of credentials (even with standard MFA), a single point of failure still exists.

The Attack: Legitimate Tools, Destructive Outcomes

The Iran-linked threat actor (associated with Void Manticore) obtained high-level administrative credentials to gain entry. Once inside, they bypassed traditional file-based defences by using Intune’s native "Remote Wipe" and "Retire" functions. To the Intune system, these appeared as authorised commands, resulting in the simultaneous factory reset of laptops, servers, and mobile devices worldwide.

The Solution: Multi-Admin Approval (MAA)

This disaster highlights a critical security gap: the "God Mode" risk of a single compromised admin account. To counter this, organisations must implement Multi-Admin Approval (MAA) for Destructive Actions within Microsoft Intune.

MAA ensures that high-impact actions - such as wiping a device, deleting an app, or changing security scripts - cannot be executed by one person alone. Instead:

  1. The Request: An administrator initiates a sensitive action (e.g., a wipe).
  2. The Guardrail: The action is placed in a "pending" state.
  3. The Approval: A second, pre-designated administrator must review and approve the request before it executes.
    This simple "four-eyes" principle effectively neutralises the impact of a single credential theft, preventing a mass-wipe event like the one seen in the Stryker attack.

How Logicalis Australia Can Help

As a trusted services integrator and a member of the Microsoft Intelligent Security Association (MISA), Logicalis Australia specialises in hardening endpoint management environments. We help organisations transition from "vulnerable" to "resilient" by:

  • Endpoint Health Assessments: Reviewing your Intune and Entra ID configurations to identify over-privileged accounts, RBAC into core M365 services.
  • Implementing Guardrails: Configuring Multi-Admin Approval (MAA), then adapting workflows tailored to your operational needs.
  • Proactive Endpoint Risk Management: Leveraging Ivanti Neurons to enhance visibility across endpoints, correlating vulnerabilities, misconfigurations, and privileged access risks. This enables organisations to identify potential attack paths and proactively remediate risks before they can be exploited, strengthening the overall security posture of the endpoint management ecosystem.
  • Endpoint Health Assessments: Logicalis Australia conducts thorough reviews of your Microsoft Intune and Entra ID environments to pinpoint over-privileged accounts and ensure proper Role-Based Access Control (RBAC) within your core Microsoft 365 services. This assessment helps uncover security gaps and supports a more resilient endpoint management strategy.
  • Zero Trust Architecture: Deploying Phishing-resistant MFA and best-practice Conditional Access policies to prevent initial credential compromise.
  • Managed Security Operations: Providing 24/7 monitoring through our global SOC to detect anomalous administrative behaviour before it scales.

Don’t wait for a "wipe" command to be the first sign of a breach. Protect your global fleet by securing the keys to your kingdom.

Reach out to the team at Logicalis Australia today to secure your digital workplace.

Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker

This video provides a detailed news report on the real-world impact of the Handala attack on Stryker, illustrating why these security measures are now a business necessity.

Topic

Related Insights