Why the Stryker Attack Still Matters. And Five Steps You Can Take Today

What it is

A Huntress blog post analyzing the March 2026 Stryker incident (attackers linked to pro-Iran group Handala hijacked Stryker's Microsoft Intune/MDM tenant, mass-wiped up to 200,000 devices, and exfiltrated 50TB), framed as a new "Weaponized Remote Wipe" class distinct from ransomware. The value beyond the summary is the operational specificity of the five defensive steps.

How it works

The attack bypassed the network perimeter entirely and hit the identity plane: privileged access to the MDM console, then a single bulk "Remote Wipe" command. Because personal phones were enrolled as fully-managed devices, they were factory-reset too. There is no decryption path — a wipe means rebuild, not restore.

Preconditions / Affected

Any org running Intune / MDM / RMM / EDR / cloud admin consoles where a single privileged identity can trigger destructive bulk actions, and any org enrolling personally-owned phones in full-device MDM rather than app-level management.

What to do

Concrete details the summary compresses:

1. Privileged-console hardening — Use phishing-resistant MFA (FIDO2 security keys) for all highly privileged identities; the page explicitly states SMS and basic app-based MFA are insufficient against session hijacking. Separate day-to-day admin roles from "break glass"/destructive roles; eliminate shared admin accounts.

1. Multi-Admin Approval (MAA) — Require a second independent approver for high-impact actions (e.g., wiping more than N devices) so "no single person can delete the company." Alert on: bulk wipes, mass profile changes, large-scale policy rollouts, and creation of new high-privilege roles or service principals.

1. BYOD — Audit current profiles for where full-device control is enforced on personal phones and what consent notice users actually saw. Move to Mobile Application Management (MAM) so corporate data can be wiped without factory-resetting personal content.

1. Out-of-band comms — Pre-build a trusted IR channel (Signal/WhatsApp group, personal email list). Store responders' personal contacts outside corporate IT — printed, or in a password manager not tied to primary SSO. Run a 30-minute drill simulating "Microsoft 365 is down" and force the team onto the out-of-band channel.

1. Practice "day zero" — (page truncates here; rehearse the total-loss scenario).

Caveats

The page is explicit that Stryker "hasn't yet confirmed the exact technical specifics" — the Intune hijack, 200,000-device figure, and 50TB exfiltration are reported/claimed details, not confirmed forensics. The 4%-of-turnover fine and NHS ordering outage are stated as attributed reports. Treat the incident specifics as illustrative; the mitigations stand on their own.