FBI disrupts Handala infrastructure after Stryker cyberattack

The FBI and the Department of Justice have seized two websites associated with Handala, a pro-Iranian hacktivist group. The law enforcement action follows the group’s claim of responsibility for a destructive cyberattack against Stryker, a U.S. medical technology company. Handala, which is believed to have ties with the Iranian regime, has been active since at least the October 7, 2023, attacks by Hamas. The group claimed the attack on Stryker—which has a workforce of 56,000 employees—was in retaliation for a U.S. government missile strike that hit an Iranian school, killing at least 175 people, most of them children. Stryker holds a $450 million contract to supply medical devices to the Department of Defense.

The seized domains were replaced by a law enforcement banner. According to the seizure announcement by the FBI and the Justice Department, “Law enforcement authorities determined this domain was used to conduct, facilitate, or support malicious cyber activities on behalf of, or in coordination with, a foreign state actor,” indicating that U.S. authorities believed the sites were run by hackers linked to a foreign government. Before the seizure, Handala used one website to publicize its hacks and another to dox dozens of people—meaning it published private information about individuals—over their alleged ties to the Israeli military and defense contractors, including Elbit Systems and NSO Group.

The cyberattack on Stryker reportedly involved hackers breaking into an internal administrator account to access the company’s Windows network. From there, they allegedly took control of Stryker’s Intune dashboards—a Microsoft tool used for managing employee laptops and mobile devices remotely—and reportedly wiped devices owned by the company and its employees. On Tuesday, Stryker stated it is still restoring its computers and internal network.

In statements posted to its Telegram channel on Thursday, Handala acknowledged that its websites were taken offline, calling the seizure a desperate attempt to silence the group’s voice. However, Nariman Gharib, a U.K.-based Iranian activist and independent cyber-espionage investigator, noted that while the group’s organizational and management structure is currently disrupted, their operations may not stop. Gharib warned that future leaks could be published by the group through media close to the IRGC, referring to Iran’s military.

Why it matters

The FBI’s seizure of Handala’s infrastructure follows a destructive cyberattack on a major U.S. medical supplier, highlighting ongoing tensions between U.S. authorities and state-linked hacking groups.