One stolen admin login wiped Stryker's devices with Intune's own button

01No malware: what was known about the Stryker wipe by 19 March

Stryker, the US medical technology company with more than 53,000 employees,³ identified the incident on 11 March and filed with the SEC the same day. It described “a global disruption” to its Microsoft environment, said it had “no indication of ransomware or malware” and that it believed the incident was contained.¹ A day later it reported that operations “continue to be disrupted, including its order processing, manufacturing and shipping”, while saying it did not believe patient-related services or its connected products were affected.² Staff were told to remove the Intune Company Portal and other management apps from their personal phones.³

The claims came from the attackers. Handala, a group BleepingComputer describes as hacktivists linked to Iran’s Ministry of Intelligence and Security, said it had stolen 50 terabytes and wiped more than 200,000 systems, servers and mobile devices, shutting offices in 79 countries.³ By 19 March the claim had become “nearly 80,000 devices”, wiped with “the built-in wipe command” in Intune. A source familiar with the incident told BleepingComputer the attackers worked from a new Global Administrator account, created after they compromised an existing administrator account.⁴

02How a device-management console becomes the weapon

A unified endpoint management (UEM) console exists to issue commands that devices cannot refuse. Enrolment hands it that authority: install this app, run this script, apply this policy, and, for a stolen laptop, erase everything and return to factory settings. A wipe is not an exploit. The device receives a correctly signed instruction from the server it was told to trust, so endpoint protection sees an operating system resetting itself, not an intruder. That is why Stryker could find no malware and still lose its devices.

The control point, then, is not the device but the person at the console. In Intune, administrative power flows from Microsoft Entra ID roles and Intune’s own role-based access control. Microsoft’s Intune team, writing two days after the attack, put the exposure plainly: “Every privileged Intune action (Intune RBAC Role Management, device wipe, script deployment) should require strong, policy-verified sign-in, not just a password.”⁶ A Global Administrator can create other administrators, which is what the source says happened.⁴

03CISA's three controls, and what each one takes away

CISA’s alert of 18 March, issued with input from Microsoft and Stryker, asks organisations to harden endpoint-management systems in three ways.⁵ Least privilege: use Intune’s role-based access control so each role holds only the actions it needs, scoped to the users and devices it serves. Phishing-resistant MFA and privileged-access hygiene: Entra Conditional Access, risk signals and privileged-access controls so that a stolen password cannot reach the admin console. Multi Admin Approval: a second administrator approves high-impact changes, naming device wipes, applications, scripts, role changes and configurations.⁵ Microsoft’s own advice adds time-bound roles through Privileged Identity Management, so nobody holds standing administrator rights, and a documented break-glass path for emergencies.⁶

04Two of seven consoles documented a second approver

CISA’s advice is written for Intune, but the risk belongs to every console that can wipe. We read the public documentation of seven device-management products in wide use globally and in India, and asked one question: by 19 March, did the vendor document a way to stop one administrator wiping devices alone?

Microsoft Intune did. Its Multi Admin Approval access policies extended to the retire, wipe and delete device actions by January 2025,⁷ and Microsoft urged customers on 13 March to put device wipe behind a second approval.⁶ 42Gears SureMDM did too. With its Four-Eyes framework switched on, a remote-wipe job becomes a request in a “Four Eyes” tab and reaches devices only once an authorised administrator approves it;⁹ 42Gears cites remote wipe and device deletion as the actions it is for.¹⁰ Omnissa Workspace ONE UEM takes a different route. Wipe protection sets a threshold, a number of wipes within a number of minutes; past it, further device wipes, enterprise wipes and deletions are held “On Hold” until an administrator approves or rejects them in the wipe log and unlocks the system.⁸ That is a brake on volume, not a second person: nothing in the page requires the approver to differ from the sender.

For Jamf Pro, Hexnode UEM, ManageEngine Mobile Device Manager Plus and Scalefusion we found no document dated on or before 19 March that describes either control. Hexnode’s help page has the administrator re-enter their own portal password to confirm a wipe,¹¹ which proves the person is signed in, the one thing a stolen login already does.

The two approaches answer different attacks. A per-wipe approval stops a single intruder at the first command but adds friction to every lost phone, which tempts teams to leave it off. A threshold leaves routine wipes alone and catches the mass event that defined Stryker, but lets through the first few devices and can be unlocked by the same hand. A buyer should want both, and should ask the vendor in writing which actions each one covers: wipe, retire, delete, and script deployment.

05The same single login runs your RMM

Remote monitoring and management (RMM) tools, the consoles IT teams and managed service providers use to patch, script and remotely control fleets, hold the same power in a different form. A script pushed to every endpoint can do what a wipe does. CISA warned in January 2023 that criminals use legitimate RMM software as a backdoor that ordinary antivirus does not flag, and that they target managed service providers and IT help desks because one provider’s access reaches many customers.¹²

Kaseya said fewer than 60 of its customers, all running VSA on-premises, were compromised, and fewer than 1,500 downstream businesses were affected.¹³ The entry point was different from Stryker’s; the multiplier was the same. Four questions carry over to any RMM: can one administrator run a script on every device without anyone else seeing it first; can roles be scoped by client and by device group; does sign-in to the console enforce phishing-resistant MFA rather than a code an attacker can relay; and does every remote command leave a log you keep outside the RMM itself.