Major U.S. medical device firm Stryker has discovered the involvement of a malicious file in the recent cyberattack by Iran-linked hacktivist operation Handala, which was claimed to have resulted in the wiping of over 200,000 devices, after initial reports that no ransomware or malware had been delivered on its systems, reports SecurityWeek.
Findings from a probe conducted alongside Palo Alto Networks and other experts showed that Handala harnessed the illicit file to execute commands to stealthily compromise Stryker's Microsoft Intune instance, said the firm in an updated statement.
"To be clear, this file was not capable of spreading either inside or outside of our environment. Most importantly, at no point has our investigation identified malicious activity directed towards our customers, suppliers, vendors, or partners," said Stryker, which emphasized significant progress in restoring systems affected by the intrusion.
Such a development comes after Handala was attributed to Iran's Ministry of Intelligence and Security by the FBI, which noted MOIS threat actors' use of Telegram for malware distribution.
Findings from a probe conducted alongside Palo Alto Networks and other experts showed that Handala harnessed the illicit file to execute commands to stealthily compromise Stryker's Microsoft Intune instance, said the firm in an updated statement.
"To be clear, this file was not capable of spreading either inside or outside of our environment. Most importantly, at no point has our investigation identified malicious activity directed towards our customers, suppliers, vendors, or partners," said Stryker, which emphasized significant progress in restoring systems affected by the intrusion.
Such a development comes after Handala was attributed to Iran's Ministry of Intelligence and Security by the FBI, which noted MOIS threat actors' use of Telegram for malware distribution.
