Remix.run Logo
Iran-backed hackers claim wiper attack on medtech firm Stryker(krebsonsecurity.com)
177 points by 2bluesc 7 hours ago | 85 comments
jacquesm an hour ago | parent | next [-]

I'm trying to imagine the kind of response the USA would inflict on a company that wiped a girls school stateside.

igleria 14 minutes ago | parent | next [-]

Extrapolate from the response to 9/11 but with 2026 technology and imagination is the only limit.

netsharc 26 minutes ago | parent | prev | next [-]

If Iran managed to get an American incel to shoot it up, the US regime would just shrug, "oh well, what can you do"...

haritha-j an hour ago | parent | prev | next [-]

They'd probably go all in, kill the leader of the nation, kill some of the successors in line, bomb the daylights out of a bunch of civillian sites, wipe out a girls school, sink a few ships... oh wait.

myth_drannon an hour ago | parent | prev [-]

USA is fortunate to have the power to respond. 9/11, Pearl harbor are examples. When Iran blew up a Jewish community center in Buenos Aires on the other hand... It took 32 years to arrange a meeting with G-d for those who are responsible.

igleria 12 minutes ago | parent | next [-]

Menem, the president at the time, and many more made every effort to cover up who was responsible.

Only in Argentina you get such an attack with no group taking responsibility. Justice system in Argentina is corrupt as hell.

inglor_cz an hour ago | parent | prev | next [-]

And some of the perps of the terror attack on Munich Olympic Games escaped retribution completely.

thyristan 31 minutes ago | parent [-]

Yes, but Germany isn't the US. We do believe in the "rules-based international order", meaning that there will be a strongly worded letter, some discussion in the UN security council, ending in a veto by China or Russia. Followed by years of nothing at all, a memorial and yearly speeches at some day of rememberance.

I'm not sure if this is any better.

mdni007 17 minutes ago | parent | prev [-]

Yes thank god the US was able to retaliate against the countries directly involved with 9/11...

Hypothetically, imagine if it ever comes out that one of our greatest allies was involved? I wonder what the reaction will be from Americans? The craziest is thing is that nothing would happen even if it were true

JonChesterfield 6 hours ago | parent | prev | next [-]

So gain access to a machine that can ask microsoft intune to eviscerate the company, ask it to do so, done. Bit of a shame all the machines had that installed really. Reminds me of crowdstrike.

shiroiuma 4 hours ago | parent | next [-]

The company should have known better than to trust their IT infrastructure to Microslop. This is their own fault.

Xylakant 4 hours ago | parent | next [-]

My 95% bet is that the attacker just gained access to an account with suitable privileges and then went on to use existing automation. The fact that it’s intune is largely irrelevant - I’m not aware of any safeguards that any provider would implemen.

So the options here are MDM or no MDM and that’s a hard choice. No MDM means that you have to trust all people to get things as basic as FDE or a sane password policy right. No option to wipe or lock lost devices. No option to unlock devices where people forgot their password. Using an MDM means having a privileged attack vector into all machines.

neo_doom an hour ago | parent [-]

No MDM just isn’t an option for most enterprises but ideally the keys to the kingdom are properly secured.

mulmen 13 minutes ago | parent [-]

How does that look exactly? Someone has to be able to use MDM to manage devices or there’s no point in having it. This scenario is firmly in rubber hose/crescent wrench cryptanalysis territory. Can updates have delays with approval gates built in? Does MDM need a break glass capability?

heraldgeezer 2 hours ago | parent | prev [-]

What alternative to Intune and, hell, the entire Office 365 suite that it is in, do you have?

Gsuite + Slack I guess. lmao. As if that is better.

Looking forward to your reply.

JonChesterfield an hour ago | parent [-]

Well, all the machines in the current outfit are Linux as far as I know. Services are self hosted. Seems to be fine, teams et al run adequately in a browser for talking to people on other stacks.

Previous place had a corporate controlled windows laptop that made a very poor thin client for accessing dev machines. One before that had a somewhat centrally managed macbook that made a very poor thin client for accessing dev machines.

You don't have to soul bond to Microsoft to get things done.

Ekaros an hour ago | parent [-]

I don't see how Linux would prevent anything if company wants similar controls on their machines. Like tracking update status, forcing updates when needed, potentially wiping entire device when stolen and so on. Fault really is not the OS but the control corporate wants over their devices. And it does make some sense.

heraldgeezer 2 hours ago | parent | prev [-]

>Bit of a shame all the machines had that installed really.

Are you new to Windows sysadmin stuff? Or you have 0 idea whatsoever and you are just vibein?

How else are we supposed to deploy/push programs and settings and in the past over SCCM, an entire OS, if the machines don't have it installed?

This is also how your precious Linux tool Ansible and Puppet works btw.

And MDMs like Mosyle for OSX. They need it installed. Because IT need to keep check on updates and settings and programs. But I suspect you are a rockstar dev and dont need no IT.

Go on, I'll wait.

mmm yeaaah just downvote me instead. Hide the wrongthink. You people need to not be so sure of yourselves.

JonChesterfield an hour ago | parent [-]

An alternative is people install the software they choose to on the machines they're using. Optionally write a list of suggested programs down somewhere.

In that world, there is no central IT team pushing changes to machines and arguing with developers about whether they really need to be able to run a debugger.

I don't know how to keep windows machines alive. It's probably harder.

pjc50 2 minutes ago | parent | next [-]

It's annoying, but it's also grossly irresponsible to let dev machines get compromised. Regardless of which OS they are running.

vntok 26 minutes ago | parent | prev [-]

I, for one, don't really want employees to install video games, porn cam clients, torrenting apps, shady vpn clients, crypto miners, remote access tools, dns "optimizers" and more generally viruses on their work computers.

Banditoz 6 hours ago | parent | prev | next [-]

Does InTune have some sort of check that goes "if over 1% of devices are wiped within a certain timeframe, stop all new device wipe requests"? Seems like it should be a feature, especially if these kinda attacks pick up.

andmarios 2 hours ago | parent | next [-]

This raises the question: Are mass layoffs less frequent than a company's MS administrator account getting hacked?

heraldgeezer 2 hours ago | parent | prev [-]

Everything is obvious in hindsight

And to be clear, SCCM and Intune is a gun.

MS will not stop you from blowing your foot off with the gun.

Remember https://www.itprotoday.com/windows-7/aggressive-configmgr-ba... ?

>During TechEd 2014, Emory University's IT department prepared and deployed Windows 7 upgrades to the campuses computers. If you've worked with ConfigMgr at all, you know that there are checks-and-balances that can be employed to ensure that only specifically targeted systems will receive an OS upgrade. In Emory University's case, the check-and-balance method failed and instead of delivering the upgrade to applicable computers, delivered Windows 7 to ALL computers including laptops, desktops, and even servers.

spwa4 2 hours ago | parent [-]

That ANY kind of config change should be rate-limited has been pretty obvious and hammered on in SRE manuals for at least 10 years.

heraldgeezer 2 hours ago | parent [-]

And who sets the limits? MS? What if a company WANTS to wipe their entire fleet?

mmsc 2 hours ago | parent | next [-]

Require dual sign off

jiggawatts an hour ago | parent | prev [-]

"Call support so they can turn off the safeties for an hour."

marijan_div 6 hours ago | parent | prev | next [-]

Stryker is far more than ambulance gurneys. They’re one of the largest med-tech suppliers, with equipment in operating rooms, ICUs, and surgical departments everywhere.

If a wiper actually hit internal systems, the bigger concern isn’t consumer data but disruption to manufacturing, logistics, and hospital support. That kind of outage could ripple through a lot of hospitals pretty quickly.

mbix77 30 minutes ago | parent | prev | next [-]

Killing 175 children would illicit such a response also from USA hackers.

0x53 5 hours ago | parent | prev | next [-]

Never add your personal device to a companies MDM…

mk89 4 hours ago | parent [-]

Never use your personal device for work, you wanted to say, probably.

heraldgeezer 2 hours ago | parent [-]

The only maybe grey area is to only us it as authenticator. But yes even then the company needs to provide this, a cheap phone works.

bingogo 6 hours ago | parent | prev | next [-]

Medtech firms consistently underinvest in corporate network cybersecurity because almost all their security and compliance spending goes to device safety requirements, not IT hardening. This is exactly the kind of gap wiper attacks target.

FreakLegion 6 hours ago | parent [-]

This was more likely an Intune admin getting phished. Intune has a built-in wipe action: https://learn.microsoft.com/en-us/intune/intune-service/remo....

RcouF1uZ4gsC 27 minutes ago | parent | prev | next [-]

I wonder if there was some confusion between Stryker the Army infantry vehicle and Stryker the medtech company.

It seems a really weird target for Iran otherwise.

cobbzilla 6 hours ago | parent | prev | next [-]

My only knowledge of this company is as a manufacturer of gurneys for ambulances.

I guess they have some sensitive data on our emergency services organizations and their headquarters addresses and accounts payable people, maybe PII on signatories (officers, board members & “important people”) and whatnot.

Anyone know if it would be worse?

serf 6 hours ago | parent [-]

>My only knowledge this company is as a manufacturer of gurneys for ambulances.

they have a tremendous catalog[0].

spend time in a hospital, dental office, rehab, etc and you'll see the logo plastered across everything.

[0]: https://www.stryker.com/us/en/portfolios/medical-surgical-eq...

cobbzilla 6 hours ago | parent [-]

yeah that is a lot of tech, but it’s all B2B- no consumer breach, right?

pastescreenshot 6 hours ago | parent [-]

Probably worse in the boring B2B way, not the consumer-breach way. Stryker is deep in hospital operations, so the immediate risk is supply chain and support disruption rather than leaked patient data. The Krebs post says one hospital system already could not order surgical supplies, and if the Intune remote wipe detail is true, recovering internal devices and admin workflows could take a while even without any medical devices themselves being compromised.

cobbzilla 6 hours ago | parent [-]

so maybe more hospitals shutdown from ransomware attacks coming?

bawolff 4 hours ago | parent | prev | next [-]

So... did they have backups?

Wipe all data kind of seems like the best kind of cyberattack if you have backups. No data falling into wrong hands, no left behind rootkits, no ransome threats etc

sofixa 3 hours ago | parent [-]

> No data falling into wrong hands, no left behind rootkits, no ransome threats etc

You won't necessarily be able to know that the data hasn't already been exfiltrated and that the backups aren't post-compromise. Or that by restoring the backup you won't get back to the state that allowed them to get in in the first place.

camillomiller 6 hours ago | parent | prev | next [-]

Seems dire but hardly a supply chain disrupting attack. Stryker is a huge supplier but it not as if this will debilitate the medical supply chain completely. Seems like the hackers found a door they could kick open easily and then justified the action ex-post.

duskdozer 6 hours ago | parent | next [-]

If they're a primary regional supplier, it could have a huge impact. It doesn't have to break the entire country to matter.

selcuka 6 hours ago | parent | prev [-]

My understanding is that the aim was not to disrupt the supply chain but to harm the company itself.

fnord77 5 hours ago | parent | prev | next [-]

That's a shame, they make impressive products

ChrisArchitect 5 hours ago | parent | prev | next [-]

Related:

Iran warns U.S. tech firms could become targets as war expands

https://news.ycombinator.com/item?id=47341007

trhway 5 hours ago | parent [-]

Well, time to dust off anti-drone defense systems. Today on NPR they talked that Iran plans to launch drones from ships into California.

https://www.10news.com/news/local-news/authorities-warn-of-p...

Fox News drone expert:

https://nypost.com/2026/03/11/us-news/iran-could-use-drones-...

RobertoG an hour ago | parent | next [-]

'Drones from ships into California' is just a psi-op for manufacturing consent. This is not our first rodeo. By now, we should know how things work.

It's not in the strategic interest of Iran to do that, and they have been very strategic and rational. It's the Americans who have abandoned rationality. The Iranian goal is very clear: they don't want to sign an agreement and be attacked again in three months or one year.

In order to get that, they want a new security framework in its part of the world. They want Israel to suffer so its population think two times before doing this again. And they want to create enough economic pain to punish the current USA administration, again to teach a lesson.

Go beyond CNN or Fox News, listen to what the Iranians are saying (1).

1- https://www.youtube.com/watch?v=lNZ_nta8NRM

trhway 21 minutes ago | parent [-]

> The Iranian goal is very clear: they don't want to sign an agreement and be attacked again in three months or one year.

Yes, of course they want to continue to do what they've been doing and not be attacked for that. Yet it is just not possible. Iran's current regime overall main goal is the spread of Islamic Revolution. Hezbollah, Hamas, Houthis - these are typical metastasis of that spread. Terrorist acts, highly visible ones, is one of the effective tools of such a spread, and that way the terrorist acts are rational in the minds of Iran's regime and their above mentioned metastatic followers. There is no security framework possible which would still allow such a spread.

4ggr0 3 hours ago | parent | prev | next [-]

> Fox News [...] expert [...] nypost.com

surely a New York Post article quoting a Fox News "expert" will be factual, unbiased and not at all an attempt to pour more oil into the fire and manufacture consent to bomb a couple more girl's schools.

botanical 4 hours ago | parent | prev | next [-]

Sounds like justification for a false flag operation by the US government. How would they transport these massive things and launch them on a different continent? That, or the US is trying to justify that this illegal war is on their doorstep and need to expand their terror.

lewispollard 2 hours ago | parent | next [-]

The drones Iran are using are actually relatively small, you can fit 5 of them into a medium sized truck and they can launch in-situ, which is how they've been using them in ground operations. Doesn't seem that much of a stretch to put a bunch of them into shipping containers.

vintermann 3 hours ago | parent | prev [-]

"Reichstag fire" attempts are definitively a legitimate concern. But as Ukraine has demonstrated, all you need to get a drone army deep into a country attacking you is a regular shipping container.

SyneRyder 4 hours ago | parent | prev | next [-]

We never did find out what those drones in New Jersey in 2024 were, did we? One Republican congressman seemed convinced at the time that he'd been informed:

BBC: Mystery New Jersey drones not from Iranian 'mothership' - Pentagon

https://www.bbc.com/news/articles/crrwz91wqd9o

It's certainly a theory / narrative that keeps appearing in the media.

heavyset_go 3 hours ago | parent | next [-]

They were flying over military installations, if they were anyone else's drones, they would have been shot down like the weather balloons that spook the government from time to time.

drumhead 3 hours ago | parent | prev [-]

They were Palantir apparently.

notenlish 5 hours ago | parent | prev | next [-]

I feel like that's not realistic, why would they launch drones to California rather than some place like DC or NY. It's a long distance.

I don't even think they'd launch drones to DC either, they seem to be all in on attacking oil infrastructure as well as us bases & defense systems in the Middle East, rather than America.

shiroiuma 4 hours ago | parent [-]

>why would they launch drones to California rather than some place like DC or NY. It's a long distance.

Because they allegedly have a ship already in the Pacific loaded with drones.

DC and NY are way too far from Iran to launch any kind of attack; the only attack they can possibly do is from a ship, and ships can be anyplace where there's deep enough water.

riffraff 5 hours ago | parent | prev [-]

> Iran plans to launch drones from ships into California

That does not make any sense to me. Does Iran have a bunch of ships in the Pacific? Why? How would they even got close enough to the US coast without being noticed at this point?

I'm not saying it's not true, I just don't understand.

bawolff 4 hours ago | parent | next [-]

If they were going to do it, it would probably look a lot like Ukraine's spiderweb attack.

However if they were going/able to do it, they probably wouldn't warn everyone and ruin the element of surprise, they would just do it.

saaaaaam 4 hours ago | parent | prev | next [-]

I’ve been seeing stuff saying China is a big customer of Iranian oil, so maybe there are oil tankers heading to China from Iran. No idea if that is actually the case though. I wonder if that Flexport shipping map that was shared here recently has any info?

pazimzadeh 4 hours ago | parent | prev [-]

Yeah that makes no sense. only thing I've heard is they have connections to some cartels in south america. venezuela is gone but I suppose they could hire some local talent and get close enough?

Seems like a really dumb idea right now, unless maybe as a last resort if Trump decides to drop tactical nukes or something

shevy-java 4 hours ago | parent | prev | next [-]

So their own faulty security is now blamed on others. That's not new.

renewiltord 4 hours ago | parent | prev | next [-]

They’ve been around for a while. Threat actors are something that I want our governments to be working on stopping. If they were capable, I would say we should run a government Project Zero but I doubt anyone would do long term service for $70k/yr when they could be making 10x-100x that.

Anyway, the bombings will have to continue till we rubble our enemies.

jonstewart 4 hours ago | parent [-]

We had a government agency working on stopping threat actors, the Cybersecurity & Infrastructure Security Agency, but then DOGE ruined it. Now it’s a shell.

renewiltord 4 hours ago | parent [-]

So the role they were fulfilling is gone entirely? What was it?

bitwize 6 hours ago | parent | prev | next [-]

The "Fucking for Virginity" approach to infosec strikes again!

LPisGood 5 hours ago | parent [-]

Can you elaborate what you mean?

Are you referring to a paradigm where people make their systems less secure in the effort to make them more secure?

bitwize 4 hours ago | parent | next [-]

Yes, exactly. In the realpolitik of organizational IT security, there's less of an emphasis on making systems more resilient to attack, much more of an emphasis on having an audit trail, so that in case the company is sued over a data breach they can claim "we did the very best that could be reasonably expected of us with the knowledge we had at the time" and provide receipts to back up that claim. Implicit in that claim is also "we used the same tools that everyone else is using so you can't blame us specially for unwittingly choosing something vulnerable to compromise". Hence the proliferation of shitty single-point-of-failure "endpoint security" software that leads to events like the 2024 Clownstrike incident.

jojobas 5 hours ago | parent | prev [-]

I think this refers to "bombing for peace". Sure the West should have just let Iran nuke whoever it wanted.

vkou 4 hours ago | parent | next [-]

Nuclear weapons are a MAD red line that will result in total annihilation of the attacker. They are only useful in a defensive capacity.

This kind of aggression, however, does seem to make their value as a deterrent clear.

Observe how nobody is fucking with North Korea like they did with Iraq or Venezuela.

sofixa 3 hours ago | parent [-]

> Nuclear weapons are a MAD red line that will result in total annihilation of the attacker. They are only useful in a defensive capacity.

Also in a "if I'm going down, everyone else is going down with me", which is Ian's strategy in this war (for good reasons). If the IRGC had nukes, and was severely threatened (like, killing the Supreme Leader and threatening to kill all of the replacements until they bend to the US/Israel will), they might have decided to go out "with style".

haritha-j an hour ago | parent | next [-]

Yes, but the whole point of having nukes as a deterrent is that the US wouldn't have arbitrarily killed their leader in the first place. "If i'm going down, everyone else is going down" is the feature, not a bug.

To be clear I don't like the idea of MAD one bit. But this is indeed how it's meant to work.

sail2boat3 3 hours ago | parent | prev [-]

Isn't this exactly what the Samson Option represents?

bitwize 3 hours ago | parent | prev | next [-]

Nothing geopolitical about it in the sense I intended, except as a reference to the Vietnam-era catchphrase. It's simply a case of "putting spyware on everybody's corporate PC for security is like fucking for virginity".

RobotToaster 4 hours ago | parent | prev [-]

Iran wasn't going to nuke anyone.

They want Islam to dominate the world, that can't happen if there isn't a world left to dominate.

jamesmishra 5 hours ago | parent | prev | next [-]

Some people on Twitter have jokingly suggested that the Iranians were looking for the maker of the Stryker military vehicle.

https://en.wikipedia.org/wiki/Stryker

Drupon 5 hours ago | parent [-]

Yeah dumbasses regularly post nonsense on Elon's X™

fartfeatures 5 hours ago | parent [-]

I'm pretty sure that is not exclusive to X.

sgc 5 hours ago | parent | prev [-]

They are trying to hurt innocents in retaliation for the US murdering their children. I understand the sentiment, but strongly disagree with acting on it. Ukraine has done a much better (of course not perfect) job of retaliating against military targets in response to russian war crimes.

Teever 4 hours ago | parent | next [-]

That’s not the motivation for these attacks at all. They’re waging asymmetric warfare against a much larger and more exposed opponent.

Their goal is to make it too troublesome for the US/Israel to continue attacking them, like a swarm of bees attacking a bear to keep it away from their honey.

Iran is in it to win it and the US is so very obviously not.

The question is if the pressure that Israel can put on the current administration greater than the pressure that Iran can put on America as a whole.

Time will tell.

dominicrose 25 minutes ago | parent [-]

Trump and republicans are now all-in in this war and this administration can tolerate a huge amount of chaos if it allows them to keep winning. It doesn't matter wether Israel pressures the administration or not. I'm not confident that the regime will fall but I am confident that it will be put in its place internationally even if it means closing the iranian borders from the outside indefinitely. BTW the US and Israel are not alone in this war.

vkou 4 hours ago | parent | prev [-]

I'm sure that if Iran had the backing of the Western world, and had their surplus of armaments funneled it's way, it would be bombing army bases and refineries and airfields and factories and port facilities in the US.

Unlike Ukraine, it does not, so it seems to be focusing on cyber vandalism and blowing up oil infrastructure in US vassal states, and other low-cost, high-ROI activities.