Technology & OSINT — 2026-03-26

Iran-Linked Handala Hackers Strike Second U.S. Medical Facility; FBI Seizes MOIS Domains After Stryker Wiper Attack

Iran-linked hacktivist persona Handala, which the FBI confirmed is operated by Iran Ministry of Intelligence and Security (MOIS), targeted a second U.S. medical institution in Maryland, disrupting hospital systems and wiping an employee workstation. The attack follows the Handala destructive wiper that hit 200,000 Stryker medical devices in early March. The DOJ seized four MOIS-controlled domains used for data exfiltration and publishing targeted individuals PII. Handala claimed retaliation for civilian casualties in the Feb. 28 U.S.-Israeli strikes on Iran. The pattern of targeting healthcare infrastructure represents an escalation in Iranian cyber retaliation against non-military critical infrastructure.

Analysis
The progression from Stryker (200,000 devices wiped) to a Maryland hospital represents deliberate escalation against healthcare, a sector with minimal cyber resilience. The FBI domain seizure confirms MOIS operational control of Handala, elevating this from hacktivist activity to state-directed cyber warfare against civilian infrastructure. This crosses the threshold that prior NSA directors identified at RSAC last week as warranting kinetic response consideration.

2 sources

Iran-linked hackers target second U.S. medical institution during war - Axios
Iran-Linked Hackers Wiped 200,000 Stryker Devices in Retaliatory Cyberattack - State of Surveillance