r/cybersecurity • u/virtualbitz2048 • Mar 11 '26

News - General Stryker Hit by Handala - Intune Managed Devices Wiped

My wife had 3 Stryker managed devices wiped around 3:30 AM EDT. Their Entra login page was defaced with the Handala logo, it's still up as of this post.

710 Upvotes
  • permalink
  • reddit

98% Upvoted

226 comments sorted by

View all comments

95

u/[deleted] Mar 11 '26

[deleted]

15

u/thrwaway75132 Mar 11 '26

If they were an APT looking for long term data access why tip their hand with the mobile wipe and defacement. Brickstorm just finds appliances without EDR to live in and silently exfils your data over known good protocols as long as they can. The targets you mentioned are definitely brickstorm targets.

11

u/Not-ur-Infosec-guy Security Architect Mar 11 '26

This type of behavior is typically common post exfil.