Iranian Hacktivist Group Handala Disrupted Following Reported Losses and FBI Seizures

The Iranian-linked hacker group Handala, responsible for the recent cyberattack on medical technology firm Stryker, is facing disruption after the FBI seized several of its websites and reports emerged of key figures being killed in military action. Intelligence officials believe the group will likely continue cyberattacks targeting U.S. Corporations, including those with a presence in Ireland.

Stryker Cyberattack and Handala’s Claim of Responsibility

Handala claimed responsibility for a significant cyberattack on Stryker, a Michigan-based medical tech company, on March 11, 2026. The attack disabled remote devices connected to Stryker’s IT systems, impacting employees and customer digital ordering systems. Production at Stryker’s Cork, Ireland facility – the company’s largest manufacturing and research location with over 4,000 employees – was halted or partially disrupted as a result of the attack. As of March 22, 2026, some employees reported production was still down. NBC News reports that the attack focused on Stryker’s Microsoft “Intune instance”, a cloud-based system for managing remote device connections.

Initial reports suggested a “wiper” attack, which would have wiped computer networks, but sources indicate the damage was primarily confined to Stryker’s mobile device management system, with the network itself remaining unaffected. It is suspected that the group obtained administrator credentials, allowing them to remove connected devices from the network.

FBI Action and Website Seizures

The FBI has seized websites associated with Handala, replacing them with a banner indicating law enforcement action. The Justice Department announced the seizure of the sites, along with backups and other related domains, characterizing them as “psychological operations” run by Iran’s Ministry of Intelligence and Security. TechCrunch reported on the seizures, noting the sites were used to publicize hacks and dox individuals allegedly linked to Israeli military and defense contractors.

Intelligence Reports and Potential Retaliation

Irish intelligence officials believe Handala is having to “reorganise” after two key figures were reportedly killed in U.S. And Israeli military action. Officials suspect that Handala, and other Iranian-backed hacker groups, will continue to target organizations globally, including U.S. Multinationals with operations in Ireland. Wired reports that Handala is widely believed to be an operation of Iran’s Ministry of Intelligence and Security.

Cyberattacks by Iranian groups have increased in response to airstrikes targeting Iranian military and intelligence sites, including the bombing of a school in southern Iran, which Handala specifically referenced in its claim of responsibility for the Stryker attack. The U.S. Has reportedly accepted responsibility for the school bombing, which resulted in the deaths of 175 civilians, most of whom were children.

Stryker’s Response and Containment Efforts

Stryker has stated that its teams are working to restore systems and that the incident has been contained to its internal Microsoft environment. The company maintains that the attack did not compromise the security or safety of its products or devices and is prioritizing the restoration of systems supporting customers, ordering, and shipping.

Looking Ahead

Intelligence agencies anticipate further cyberattacks from Iranian-backed groups, potentially broadening their targets beyond U.S. Corporations to include countries hosting U.S. Military bases. The disruption of Handala’s operations, while significant, does not necessarily eliminate the threat, as the group may reorganize or be replaced by other Iranian-backed actors.