Stryker: device management used to wipe the company
Attackers took over an Intune admin account at Stryker and used it to wipe devices across the company. Your MDM can do the same.
On 11 March, medical device maker Stryker was hit by a destructive attack. According to reports, the attackers, an Iran-linked group calling itself Handala, compromised a Microsoft Intune administrator account, created a new global admin, and used Intune’s own remote wipe to factory-reset devices across the company, including staff’s personal phones enrolled in the BYOD programme. Estimates of the number of devices vary widely. Stryker says it found no sign that data was taken.
No malware was needed. The management tool did exactly what it was designed to do.
- Require phishing-resistant MFA for every admin of Intune, Entra or any MDM.
- Turn on Intune’s multi-admin approval for wipes and other destructive actions.
- Alert on new global admins, and on bulk wipe or retire commands.
- Use separate admin accounts that don’t read email.
- Check what a wipe does to personal phones in your BYOD setup. A selective wipe of work data is usually enough.