Threats & Adversaries · Credential Theft

FBI takedown of Handala websites after Stryker mass-wipe

U.S. authorities seized two websites tied to Handala after the group claimed a March 11 attack that disrupted Stryker's global Microsoft environment. Analysis indicates harvested administrator credentials were likely used to abuse Microsoft Intune to wipe managed devices, halting order processing, manufacturing and shipping.

6 sources · Mar 19

Timeline

Sources

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-03-20

Every edition of this story: FBI takedown of Handala websites after Stryker mass-wipe

More from today