Stryker Corporation disclosed that its investigation into the March 11 cyberattack has uncovered a custom malicious file used by the Iran-linked Handala group. The disclosure, reported by SecurityWeek, is the first confirmation that the attackers built bespoke tools — not just exploited legitimate Microsoft Intune administration accounts. [1]

When this paper covered the original attack, the narrative centered on Handala using Intune to push wiper commands to over 200,000 devices globally. That was "living off the land" — abusing tools already inside the environment. The new finding changes the picture. A custom-built malicious file means the attackers invested development time in purpose-built capabilities. [2]

Palo Alto Networks' Unit 42 assessed the broader threat as contained but published an advisory on increased wiper attacks by Handala, also known as Void Manticore. The FBI issued an alert formally linking Handala to Iran's Ministry of Intelligence and Security. The U.S. government had previously connected the group to Iran but had not made the specific MOIS attribution official.

The distinction matters for policy. MOIS-linked operations imply state direction, not merely state tolerance. That raises the attack from hacktivist disruption to an act of state-sponsored sabotage during wartime.

-- Kenji Nakamura, Tokyo