Lessons from the Stryker Incident
The Stryker incident demonstrates how attackers can leverage Microsoft Entra ID and Intune as destructive control planes, wiping devices and disrupting operations without deploying malware. This advisory outlines the key tactics observed and provides practical steps to reduce risk and strengthen resilience.
Executive summary
The Stryker incident shows that compromise of the Microsoft identity and endpoint management plane can cause enterprise-scale destructive impact without conventional ransomware or endpoint malware. The practical implication is straightforward: Entra ID and Intune should be protected as critical control planes, alongside Active Directory, EDR, and backup administration.
Stryker incident review
Confirmed: On 11 Mar 2026, Stryker disclosed a cyber incident that caused global disruption to its Microsoft environment and affected access to systems supporting operations and corporate functions.
Confirmed: On 16 Mar, Stryker stated that the threat actor used Microsoft Intune to wipe its internal virtual infrastructure, rendering laptops, mobile devices, and virtual servers inoperable; Stryker also stated that this was not ransomware and that no malware was deployed.
Confirmed: Stryker stated that the incident was contained to its internal Microsoft environment; products remained safe to use, but ordering, manufacturing, and shipping were disrupted during recovery.
Assumed/reported: The Iranian attack group Handala claimed responsibility and is publicly assessed by Unit 42 as a front group directed by Iran’s Ministry of Intelligence and Security (MOIS). External reporting further indicates compromise of an administrator account, creation of a new Global Administrator, and mass wiping of tens of thousands of devices; these details have not been publicly confirmed by Stryker.
Tactics, Techniques, and Procedures (TTPs)
Confirmed: Destructive use of a legitimate Intune wipe function against internal IT rather than a conventional malware payload.
Assumed: Privileged identity compromise in Entra ID/Intune, followed by role expansion or abuse of broad administrative rights.
Assumed: Living-off-the-land through SaaS administration, reducing the chance of endpoint-based detection and accelerating tenant-wide impact.
Mitigations and recommendations
Treat Entra ID and Intune as Tier 0
Move administration to dedicated cloud-only accounts, allow high-privilege access only from privileged access workstations (PAWs) or compliant managed devices, and restrict break-glass accounts to emergency use with high-severity alerting.
Remove standing privilege and over-broad scope
Inventory Global Administrator and Intune Administrator assignments, replace them with Intune role-based access control (RBAC) or custom roles, apply scope tags by region or business unit, and move privileged access to privileged identity management (PIM) or just-in-time (JIT) access with approval and reauthentication.
Put destructive actions behind dual control
Enable Multi Admin Approval for wipe, delete, script deployment, and RBAC changes, and maintain a 24/7 approver roster so that one compromised admin cannot trigger tenant-wide impact.
Harden and monitor privileged sign-in paths
Require phishing-resistant MFA for all Entra ID/Intune admins, enforce Conditional Access by admin portal, risk, and location, and alert on new privileged-role assignments, unusual admin geolocation, and mass wipe/factory reset/retire actions in Intune audit logs.
Prepare for mass managed-device loss
test Autopilot or equivalent rebuild flows, validate re-enrollment of laptops, mobiles, and virtual servers, separate BYOD from full-device wipe permissions, and rehearse manual fallbacks for order management and other critical operations.
Sygnia’s best practices
This incident reinforces Sygnia’s previous recommendations. Identity hardening and wiper readiness remain the core priorities, but crown-jewel scoping should explicitly include Entra ID, Intune and other enterprise control planes.
The main adjustment is operational. IR playbooks and detections should extend beyond EDR to tenant lockdown, session revocation, privileged-role disablement, and cloud identity/audit telemetry, because destructive impact can be delivered through legitimate SaaS administration.
References
- Stryker, Form 8-K, 11 Mar 2026.
- Stryker, Customer Updates: Network Disruption, Mar 2026.
- Stryker cyber incident response certification letter, 16 Mar 2026.
- Microsoft Learn, Remote Device Action: Wipe; Use Access policies to require Multi Admin Approval.
- Microsoft Tech Community, Best practices for securing Microsoft Intune, 13 Mar 2026.
- Palo Alto Unit 42, Increased Risk of Wiper Attacks, Mar 2026; Bleeping Computer, Stryker attack wiped tens of thousands of devices, no malware needed, 16 Mar 2026.
Omer Kidron. (2026, March 22). Lessons from the Stryker Incident, Sygnia.
https://sygnia-stg.prpl.global/threat-reports-and-advisories/identity-control-plane-attack-stryker/
Related Resources
By clicking Subscribe, I agree to the use of my personal data in accordance with Sygnia Privacy Policy. Sygnia will not sell, trade, lease, or rent your personal data to third parties.