Who Is Handala — The Iran-Linked Ghost Group That Just Wiped 200K Stryker Devices

A destructive cyberattack attributed to the Handala group (linked by analysts to MOIS-affiliated Void Manticore) disrupted Stryker’s global Microsoft environment: attackers reportedly abused Microsoft Intune to remotely wipe managed endpoints, claimed to have exfiltrated ~50 TB of data and wiped over 200,000 devices, and forced operational shutdowns across multiple countries; reporting describes use of Rhadamanthys infostealer, custom wipers, living‑off‑the‑land lateral movement, and pre-positioned access to maximize impact.