March 12, 2026
Kevin Collier
An Iran-linked hacker group has claimed responsibility for a cyberattack of a medical tech company, in what appears to be the first significant instance of Iran hacking an American company since the start of war between the countries.
Kevin Collier
An Iran-linked hacker group has claimed responsibility for a cyberattack of a medical tech company, in what appears to be the first significant instance of Iran hacking an American company since the start of war between the countries.
Historically, Iran has conducted some of the most infamous “wiper” cyberattacks on national enemies, aiming to simply erase all data on a computer’s networks. Victims include Saudi Aramco, Saudi Arabia’s national oil company, in 2012, and the Sands Casino in 2014.
Since the war started, some established hacker groups sympathetic to Iranian leadership have claimed minor attacks, but most have been relegated to briefly altering the appearance of a website and none have appeared to have had major impact. Some tech and cybersecurity companies, including Google, and the email cybersecurity company Proofpoint, have told NBC News that they have largely seen Iran’s hackers conducting espionage related to the war.
But that appears to have changed Wednesday, with what appears to have been a different type of attack that also deleted information from devices. One Stryker employee, who requested to not be identified because they are not authorized to speak for the company, said that employee’s work issued phones stopped working, dragging work and communications with colleagues to a standstill.
Handala Team has claimed responsibility for the Stryker hack in statements posted to its Telegram and X accounts. The group routinely brags about its exploits on the social media platforms, which have in recent days taken down previous versions of their accounts.
Specifics of how the hack was conducted are not clear. But public evidence of the hack points to the likelihood that hackers gained access to the company’s Microsoft Intune account, which the employee confirmed Stryker uses. From there, Handala appears to have wiped some employee’s devices back to factory settings, one expert said.
“They seem to have obtained access to the Microsoft Intune management console. This is a solution for managing corporate devices,” said Rafe Pilling, the director of threat intelligence at the cybersecurity company Sophos, which has tied Handala to Iran’s Ministry of Intelligence agency.
“One of the features is the ability to remotely wipe a device if it’s lost/stolen etc. Looks like they triggered that for some or all of the enrolled devices,” he said.
Microsoft’s website describes the remote wipe feature as “commonly used when a device needs to be retired, repurposed, reset for troubleshooting, or securely erased if lost or stolen.”
In a statement published to its website Wednesday, Stryker said that the disruption was due to a cyberattack, but that its own systems were not directly hacked and that ransomware — a common type of cybercrime that can also significantly disrupt companies’ networks — was not a factor.
“Stryker is experiencing a global network disruption to our Microsoft environment as a result of a cyber attack. We have no indication of ransomware or malware and believe the incident is contained,” the statement said.
The company did not respond to a request for further details. Microsoft did not respond to a request for comment.
Joshua Keating
Key takeaways
- The duration of the US-Israel may come down to ammunition stockpiles, as both sides face mounting strain in an expensive missile-and-interceptor arms race.
- While US and Israeli strikes have severely degraded Iran’s missile infrastructure and launch capacity, Iran is adapting by spreading out targets, relying on cheaper drones, and aiming to inflict psychological and economic pain rather destroy military targets.
- Even with high interception rates, the staggering cost and limited production of advanced US defense systems like Patriot and THAAD risk depleting Western stockpiles, with global ripple effects that could shape future conflicts beyond the Middle East.
But continuing the war isn’t just a question of will; it’s a question of means. And one key constraint on how long the conflict might rage is how much ammunition each side has to continue it. Currently, it’s an arms race between Iranian missiles and drones and US, Israeli, and Gulf State countermeasures to shoot them down. And while the answers to questions about their capacity are closely guarded, there are signs of strain on both sides.
With its conventional military overmatched and its network of regional allies badly degraded, Iran’s main remaining means of “fighting” is its missile and drone stockpile.
Iran has fired thousands of missiles and one-way attack drones at 13 countries, killing at least 43 people, according to data compiled by the Israeli think tank INSS. These include seven US servicemembers. Iran has struck a wide range of targets, from US military bases to luxury hotels in Dubai to Amazon data centers. On Wednesday, three ships transiting the Strait of Hormuz came under drone attack as part of Iran’s effort to shut down one of the key chokepoints of the world energy market.
This is dwarfed by the damage that has been inflicted by the US and Israel on Iran, where more than 1,200 people have been killed according to Iranian authorities, and much of the country’s military and political infrastructure has been destroyed.
But Iran’s attacks would have been far worse for the wider region if the countries they were going after didn’t have such strong defenses against missiles and drones. Most of the countries that have been heavily targeted appear to be successfully intercepting over 90 percent of the projectiles Iran has fired at them.
Doing so is not easy, however. Interceptors are among the world’s most sophisticated and in-demand weapons, and the successful interception effort has come at a tremendous cost.
The US burned through an estimated $2.4 billion worth of Patriot interceptors, which cost around $4 million each, in just the first five days of this war. During last June’s conflict, the US used around a quarter of its total stock of THAAD interceptors, which are fired from a mobile anti-missile battery. Only around 11 interceptors are made per year, and the use rate is likely similar this time around.
“You’re on the wrong side of the cost curve if you are doing missile defense in the first place,” said Sam Lair of the James Martin Center for Nonproliferation Studies. “That’s just the reality of how these, these types of wars work. Interceptors are expensive, they don’t have very many of them, and not many of them are produced each year.”
These kinds of interceptors have sometimes been referred to as “the table stakes” of today’s missile and drone-heavy wars, and the reverberations of the current Mideast missile war are being felt well beyond the region. European officials say interceptors needed for the war in Ukraine are being diverted to the Middle East. In a sign of just how pressing the need has become, the US is reportedly moving parts of a powerful THAAD interceptor system from South Korea to the Middle East on the same week that North Korea is test-firing missiles from its latest warship.
Offensive weapons, while a lesser concern, are also an issue: The US may need years to replenish its stocks of Tomahawk missiles, to take one example.
“For years, all of the services have been firing precision stocks much faster than their replacement rates,” said MacKenzie Eaglen, a defense analyst at the American Enterprise Institute.
How long can Iran keep firing?
Heavy US and Israeli bombardment of Iran’s missile facilities is taking a toll on its ability to fire them in the first place. According to the US military, the number of Iranian missile launches is down 90 percent, and drone launches are down 83 percent since the start of the conflict, which Secretary of Defense Pete Hegseth called “strong evidence of degradation.”
Some experts believe the drop in launches is evidence that Iran is holding back some of its arsenal, anticipating a long fight, but it’s still safe to say that by any conventional metric, Iran is “losing” the missile war.
But the goal of Iran’s leaders is not to defeat the US and Israel — there was never any question of that — it’s to continue to inflict pain to the point where Trump, facing skyrocketing gas prices, a jittery economy, falling poll numbers, and grumbling allies, decides to call it quits and resist calls to renew the war again later.
Prior to last June’s “12-day war,” Iran was believed to have between 2,000 and 3,000 missiles in its stockpile. It fired around 600 in that conflict, and many more were destroyed on the ground by Israeli airstrikes, but in the months since, Iranian authorities had worked to replenish those stockpiles and harden their defenses.
Many of these were concentrated in vast underground “missile cities.” In the early phase of the war, these were hit heavily, and Iran’s own air defenses proved mostly unable to defend them. Mobile launchers were often destroyed immediately after leaving the facilities. The US has used bunker buster bombs to destroy the entrances to the cities, leaving hundreds of missiles buried underground. Israel estimates that it has destroyed or buried around 70 percent of Iran’s missile launchers. Even if those estimates are on the high end, the speed at which the US and Israel have been able to dismantle much of Iran’s once-feared missile deterrent has surprised many observers.
Iran has also been something of a pioneer in the development of one-way attack drones. The low-cost Iranian “Shahed” has been used extensively by Russia’s military against Ukrainian cities for years. The US is now deploying its own drone closely modeled on the weapon. The size of Iran’s drone stockpile is unknown, but before the war, its production capacity was estimated at around 10,000 per month, though it’s surely less now.
While less powerful, these drones could be pivotal in Iran’s efforts to keep the Strait of Hormuz closed to oil exports. In this campaign, the Iranians may have taken some lessons from their Yemeni allies, who used a relatively small number of drones and missiles to create chaos in the Red Sea during the war in Gaza.
Iran’s choice of targets in this war has been somewhat unexpected. While some feared a massive salvo against Israel that would overwhelm the country’s air defenses, the strikes have been more spread out, with 20 times more total projectiles directed against the Gulf states than Israel. This may partly be the result of the damage inflicted on the command structure of Iran’s Revolutionary Guard Corps (IRGC) — Iranian doctrine gives missile commanders wide latitude to choose their targets when they don’t have word from Tehran.
“It was 30 different IRGC, commanders doing their own thing, and that’s why we saw them doing things like launching against Oman, which made no sense to anybody,” said Decker Eveleth, an analyst at the Center for Naval Analyses, noting that Oman was the country that had attempted to mediate a nuclear agreement between Iran and the United States in the lead-up to the war.
Iran may also be targeting the Gulf because those are the missiles it still has available. It used many of its longer-range weapons to strike Israel during the 12-day war. Its shorter-range missiles, aimed primarily at the Gulf and US bases in the region, were relatively untouched and were not as heavily bombed in the early days of this war. They’ve been hit more heavily over the last few days. By striking airports and hotels rather than military targets, Iran may also be aiming to demoralize and frighten local populations, building on similar attacks against Israeli cities during the 12-day war last year. “They started hitting a lot more civilian areas,” Nicole Grajewski of the Carnegie Endowment for International Peace said. “It turned out to have a high psychological cost for the Israelis — it was pretty terrorizing for them at the population level.”
The hope may be that the damage to regional countries may get to the point that their governments start putting more pressure on Trump to end the war, though it could also have the adverse effect of drawing them into the conflict directly.
As for Israel itself, Iran has begun launching missiles fitted with cluster munitions that burst at high altitude, scattering tiny bomblets. While not particularly effective against hardened military targets, these have the advantage of being difficult to intercept. (They’re also banned by more than 120 countries because of the dangers unexploded bomblets can pose to civilians long after conflicts end.)
A numbers game
Despite the high intercept rates, there are signs that the region was not fully prepared for the Iranian onslaught.
Some analysts have questioned why the six US troops killed in Kuwait on March 1 were working in what appeared to be a makeshift operations center, given that it was the US that determined when the war began. Axios has reported that US officials last year rejected a Ukrainian offer to sell the same anti-drone technology it is now installing under fire. There were also reports early in the war that Gulf states were running dangerously short on interceptors and that the US was scrambling to provide them with more. Countries like Saudi Arabia and the UAE rely on advanced US-made systems like Patriot and THAAD for air defense, which, though highly effective, are extremely expensive and ill-suited to take on large numbers of cheap missiles and drones.
The UAE has had success in using helicopters to shoot down drones at a lower cost, and experts from Ukraine — a country that now knows a thing or two about shooting down missiles and Iranian-made drones —have been dispatched to the region to consult. Overall, the fear of running out of interceptors has become less acute as the number of Iranian launches has dropped.
As for Israel, it isn’t publicizing its intercept rate this time around in order to make it harder to assess its stockpiles, but the country was also reportedly running low on stockpiles at the end of the 12-day war.
Iran is still getting some missiles and drones to their targets. On March 10, more than 25 percent of drones fired at the UAE got through, significantly higher than previous days. Iran also now appears to be targeting the radar facilities used by the US to track incoming missiles.
Modern interceptors may be able to take down most of what Iran is firing at US troops and the cities of the Middle East in this war for now. But the impact may be felt in the next one. And even if Iran no longer has enough resources to overwhelm the region’s defenses, they may hope they can keep up the threat long enough for the costs to become intolerable.
No comments:
Post a Comment