WRAVEN Intel Brief

Key Points:

Stryker confirmed a cyber incident on March 11 that disrupted its global Microsoft environment.
The company reports no evidence of ransomware or malware and believes the incident is contained.
Public attribution currently points to Handala, an Iran-linked persona tied to MOIS-affiliated actor Void Manticore / Red Sandstorm.
Actor claims of 200k wiped systems and 50 TB exfiltration remain unverified.
Operational disruptions include ordering, manufacturing, shipping, and internal systems.

Stryker has publicly confirmed a cyberattack that caused a global disruption to its Microsoft environment. The company states it has no indication of ransomware or malware, believes the incident is contained, and says key patient-facing or connected products including LIFEPAK, LIFENET, Mako, Vocera, and LIFEPAK35 are not impacted. At the same time, Stryker has acknowledged continuing disruption to operations including ordering, manufacturing, shipping, and access to internal systems and applications.

Public attribution has converged on Handala, which Check Point identifies as a persona operated by Void Manticore / Red Sandstorm / Banished Kitten, an actor affiliated with Iran’s Ministry of Intelligence and Security (MOIS). Palo Alto Unit 42 and Sophos reporting are broadly aligned on Handala as an Iran-linked front or persona associated with destructive and hack-and-leak operations.

The key caution is that the company’s statements and the actor’s claims do not fully align yet. Stryker says it sees no ransomware or malware and is still assessing impact, while Handala and some external reporting describe widespread wiping and large-scale data theft. Those claims are not publicly validated by Stryker, CISA, or the FBI at this time.

What Stryker Has Said

Stryker’s public updates dated March 11 and March 12 state that the incident caused a global network disruption affecting its Microsoft environment, that the company has no indication of ransomware or malware, and that it believes the event is contained.

Stryker also stated:

LIFEPAK devices are not impacted and operate independently of the Stryker network.
LIFENET continues to function normally, though some ePCR vendors or hospitals may have paused transmissions.
Mako is not a connected device, and case planning can still be handled locally or carried directly to the system.
Vocera and LIFEPAK35 are safe to use.
The company still has visibility into orders entered before the event, but later orders are being examined while electronic ordering is being restored.

In its SEC 8-K, Stryker said it identified the incident on March 11, 2026, activated its cyber response plan, and brought in external advisors and cybersecurity experts.

Reuters reported on March 12 that Stryker flagged disruption to orders, manufacturing, and shipping operations.

Scale and Numbers

Stryker’s corporate materials state that it operates in 61 countries, has about 56,000 employees, and impacts more than 150 million patients annually. Its 2024 company facts page lists $22.6 billion in global sales for 2024.

Stryker’s 2024 Form 10-K states that it sells products in about 75 countries and has roughly 27 company-owned and 297 leased locations worldwide, including 45 manufacturing locations.

Market reaction was immediate. Reuters reported Stryker shares fell roughly 3% to 3.6% after the incident became public.

Handala has claimed that it wiped over 200,000 systems, servers, and mobile devices and exfiltrated 50 TB of data. These are actor claims only and are not confirmed by Stryker or U.S. government agencies at this time.

Who Is Handala

Check Point’s March 12 report is the strongest public technical source currently available. It states:

Handala is an online persona operated by Void Manticore, also tracked as Red Sandstorm and Banished Kitten.
Void Manticore is assessed as MOIS-affiliated.
Handala is one of several personas tied to the same cluster, alongside Karma and Homeland Justice.
The actor favors quick, hands-on intrusions, often with destructive wiping, hack-and-leak operations, and propaganda-driven messaging.

Sophos also describes Handala as a hacktivist persona linked to Iran’s MOIS and notes that while the group may exaggerate impact, it has been associated with data theft and wiper attacks.

Palo Alto Unit 42 likewise identifies Handala as a prominent Iran-linked persona in the current escalation environment.

Reported Tradecraft

According to Check Point, Handala has used:

Compromised VPN accounts and brute-force or credential-based access for initial entry.
Targeting of IT and service providers to obtain credentials and reach downstream victims.
Hands-on-keyboard activity involving RDP, simple tunneling, and fast destructive actions.
NetBird for tunneling into victim environments.
Parallel deployment of multiple wiping methods through Group Policy to maximize damage.

Check Point describes four distinct wiping techniques in one observed intrusion and says one PowerShell wiper was likely written with AI assistance. It also says the PowerShell component deleted files under C:\Users and dropped propaganda imagery across drives.

This matters even if some actor claims are inflated. The TTP family is real, the destructive capability is real, and the healthcare-adjacent targeting pattern is real.

Public IoCs

There are no public Stryker-specific IoCs from Stryker, CISA, or the FBI that could be independently verified as of March 12, 2026. The public indicators below are from Check Point’s Handala reporting and should be treated as Handala-related indicators, not confirmed Stryker victim-side indicators.

Malware Hashes

Handala Wiper: 5986ab04dd6b3d259935249741d3eff2
Handala PowerShell Wiper: 3cb9dea916432ffb8784ac36d1f2d3cd
VeraCrypt Installer: 3236facc7a30df4ba4e57fddfba41ec5
NetBird Installer: 3dfb151d082df7937b01e2bb6030fe4a
NetBird: e035c858c1969cffc1a4978b86e90a30

Infrastructure

82.25.35[.]25
31.57.35[.]223
107.189.19[.]52
VPN exit node: 146.185.219[.]235
Observed Starlink IP ranges: 188.92.255.X, 209.198.131.X
Observed commercial VPN ranges: 149.88.26.X, 169.150.227.X

Hostname Patterns / Systems Observed

WIN-P1B7V100IIS
DESKTOP-FK1NPHF
DESKTOP-R1FMLQP
WIN-DS6S0HEU0CA
DESKTOP-T3SOB36
WIN-GPPA5GI4QQJ
VULTR-GUEST

These are useful as hunting leads, not standalone proof of attribution.

Government Information and Official Posture

CISA has reportedly launched an investigation into the Stryker incident. Nextgov reported that Acting Director Nick Andersen said CISA is working with public- and private-sector partners and providing technical assistance related to the targeted attack.

A June 30, 2025 joint fact sheet from CISA, FBI, NSA, and DC3 warned that Iranian-affiliated cyber actors and aligned hacktivist groups may target vulnerable U.S. organizations, often exploiting unpatched internet-facing services, known vulnerabilities, and weak or default credentials.

CISA’s earlier 2020 advisory on Iranian cyber response specifically warned about possible wiper activity and disruptive operations during periods of U.S.-Iran tension.

CISA’s 2022 Albania advisory publicly linked the Homeland Justice persona to Iranian state cyber actors. This is relevant because Check Point ties Homeland Justice and Handala to the same broader operator cluster.

HHS HC3 has also published healthcare-focused analysis on Iranian threat actors, reinforcing that the healthcare sector remains a relevant concern area for Iranian cyber activity.

Assessment

Current public attribution is strong enough to describe this as an incident attributed to Handala, an Iran-linked and MOIS-associated persona, but not strong enough to make detailed claims about the exact Stryker intrusion path without additional evidence.

The most plausible current assessment is:

This was a disruptive and possibly destructive operation against a major U.S. medical technology company.
The actor’s likely objectives were operational disruption, propaganda value, and coercive signaling, not ordinary cybercrime monetization.
The healthcare and medtech angle raises supply-chain and continuity risk, even if key patient-facing devices were not directly compromised.
The public record still lacks enough detail to determine whether the access path involved identity compromise, supplier compromise, VPN abuse, MDM misuse, or another method.