ConflictClarifier

2026伊朗-海湾危机追踪
CC
Events Archive
strikeMar 19, 2026

Microsoft Intune: Lock it down, warn feds after Stryker

Summary

Lock down Microsoft Intune, feds warn after Stryker attack Iran-linked attackers wiped employees' devices using Intune The US government has urged companies to better secure Microsoft Intune, an endpoint management tool that was abused in last week's cyberattack against med-tech firm Stryker. Handala, a group linked to Iran's intelligence agency, claimed responsibility for the attack, which knocked some of the surgical equipment maker's networks offline and continues to affect shipping and ordering systems. Stryker has publicly said the attack affected its Microsoft environment, and a source familiar with the investigation confirmed to The Register that the attackers wiped employees' devices using Intune. Microsoft to date has declined to comment. In a Wednesday security alert, the US Cybersecurity and Infrastructure Security Agency (CISA) said it is "aware of malicious cyber activity targeting endpoint management systems of US organizations" following the Stryker intrusion, and urged companies to follow Microsoft's best practices for securing Intune. Redmond published this guidance three days after the cyberattack. - Iran's cyberattack against med tech firm is 'just the beginning' - Iran-linked cyber crew says they hit US med-tech firm - Cybercrime isn't just a cover for Iran's government goons - it's a key part of their operations - Another massive security snafu hits Microsoft, but don't expect it to stick Among the recommendations: Use principles of least privilege when designing administrative roles. This can prevent someone who has breached Intune – as appears to be the case in the Stryker intrusion – from creating new admin accounts and using these to control employees' access to internal systems and perform wipe commands. Companies should use Intune's role-based access controls to assign only the minimum permissions necessary to each role for complete day-to-day operations. ®

Actors involved

USIran

Sources

  • Jessica LyonsBy Jessica Lyons

    Lock down Microsoft Intune, feds warn after Stryker attack Iran-linked attackers wiped employees' devices using Intune The US government has urged companies to better secure Microsoft Intune, an endpoint management tool that was abused in last week's cyberattack against med-tech

See this event through different lenses

Compare how Western, Iranian, Israeli, Global South, and Pro-Peace perspectives frame this event.

Compare Perspectives

Community Notes

Community Notes

Loading notes...

Related events

strikeUnverifiedUSIsraelIranProxyRussiaUkraine
1 source

Jordan, a U.S. ally hosting American military forces, has faced repeated drone and missile attacks, which reports suggest are linked to Iranian operations, alongside broader economic challenges and regional instability. Despite these security risks, Jordanian officials have affirmed their commitment to the alliance, while King Abdullah II warned that current global and regional disruptions pose a broad threat to international stability.

Location: Jordan
strikeUnverifiedUSIsraelIran
1 source

Oil prices rose this week as conflict intensified in the six-month war, with Iran reportedly maintaining control of the Strait of Hormuz while the US presses a counter-blockade of Iranian ports. Iranian authorities claimed to have targeted US military assets in Kuwait and the UAE, though Kuwait confirmed intercepting a missile and drone attack on its air base, while the UAE reported no evidence of an attack on its own facilities.

These exchanges followed Iran’s attribution of a deadly wedding strike in Kuhestak to the US, a claim US Vice President JD Vance stated is currently under investigation but disputed by Washington.

Location: Iran
strikeUnverifiedUSIran
1 source

U.S. officials state that Central Command is conducting an internal review following Iranian reports of five deaths and 67 injuries at a wedding venue during Tuesday's strikes, although it remains unconfirmed that the incident resulted from a U.S. attack.

While CENTCOM emphasizes that it does not target civilians and notes that initial reports originated from Iranian state media, Vice President JD Vance confirmed the military is investigating the claims to verify the circumstances.

Location: Iran
strikeUnverifiedUSIsraelIranRussiaChina
1 source

The Trump administration is combining economic sanctions with renewed military strikes against Iran, a strategy that has failed to compel Tehran to negotiate despite escalating tensions. While President Trump stated he does not consider electoral impacts in his decision-making, the ongoing conflict continues to affect global energy prices and political polling ahead of the midterm elections.

Location: Iran