FBI Seizes Sites Of Hacking Group Behind Data-Wiping Attack On Stryker

The FBI has seized two sites belonging to the pro-Iranian hacking group behind the data-wiping cyberattack on US medical equipment provider Stryker.

The two sites for the hacking group Handala have been spotted displaying seizure notices that say the FBI received a court warrant to take over the domains.

“This seizure is part of a continuing FBI operation to identify, disrupt, and hold accountable those responsible for hostile cyber activities directed against the United States, its institutions, and its partners,” the notices add.

The FBI didn’t immediately respond to a request for comment. But domain lookups confirm the two Handala sites now redirect to FBI servers.

This Tweet is currently unavailable. It might be loading or has been removed.

The seizures occur when Handala has been bragging about last week’s attack on Stryker; although no medical devices were affected, the breach allowed the group to wipe data over the company IT systems, along with employee phones.

“During this operation, over 200,000 critical systems of this company were targeted and 12 petabytes of data (equivalent to 12,000 terabytes) were permanently wiped,” the group claimed in a post on one of seized sites on Monday. The same post included screenshots, indicating the hacking group was able to gain access to Stryker’s internal systems and possibly steal files.

The FBI’s seizure of the two sites might help federal investigators uncover details about the hacking group, which was previously involved in pro-Palestinian hacktivism. But according to a message posted on Telegram, Handala is already preparing to launch a new site to replace the seized domains.

Tammy Harper, a security researcher at Flare, also wrote: So while the domains are down for now, this looks more like a disruption of their distribution layer than anything else. And based on how they’ve operated so far, it’s unlikely to slow them down for long.”

Recommended by Our Editors

Handala pulled off the data-wiping operation by targeting Stryker’s Microsoft software environments, including InTune, which lets companies remotely control and manage devices, including Android and iOS phones. However, BleepingComputer reports that the hacker-initiated wipe command through InTune only affected nearly 88,000 devices, rather than 200,000, and that there’s no evidence that Handala exfiltrated data.

For now, Stryker has only said in an update posted on Sunday: “The event only affected Stryker’s internal Microsoft corporate environment. This was not a ransomware attack, and there is no evidence of malware deployed to our systems. The incident has been contained, and we are now in the restoration process, which is progressing steadily.”

The attack “did not affect any of our products—connected or otherwise,” the company added. “We are prioritizing restoration of systems that directly support customers, ordering and shipping. Our core transactional systems are already on a clear path to full recovery, and we will continue to provide updates as progress is made.”