CISA urges companies to secure Microsoft Intune systems after hackers mass-wipe Stryker devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a strong warning to organizations about the importance of securing their device management systems. This alert follows a significant breach at medical technology firm Stryker, where pro-Iranian hackers successfully infiltrated the company and wiped thousands of employee devices, including phones, tablets, and computers. On Thursday, CISA highlighted that hackers exploited vulnerabilities in Stryker's Windows-based network to manipulate its endpoint device systems, leading to substantial disruptions in the company's global operations. As part of their recommendations, CISA advised network administrators to implement stricter controls on user accounts with access to critical systems like Microsoft Intune. These changes would require a second administrator's approval for making sensitive modifications, such as erasing devices. Stryker, which specializes in medical devices and hospital equipment, reported on March 11 that it had fallen victim to a cyberattack, causing what they described as "global disruption" to their network. While the company confirmed that no malware or ransomware was deployed during the attack, it was reported that the hackers abused their access to Stryker's internal systems to remotely delete data from tens of thousands of devices, which included personal electronics connected to Stryker's network. The company has managed to contain the attack and is working on restoring its systems. Although the medical devices remain functional, Stryker's supply, ordering, and shipping systems are still offline, and the company has not provided a timeline for full recovery. Stryker did not respond to inquiries from TechCrunch regarding the incident. The hacktivist group known as Handala claimed responsibility for the assault on Stryker, citing it as retaliation for a U.S. airstrike that resulted in civilian casualties in Iran. They alleged that they had stolen a significant amount of data from Stryker's network, although they have yet to present any evidence to support this assertion. In a related development, the FBI has taken action against the Handala group's website, as reported by TechCrunch.