Technical analysis of the Stryker cyberattack. How the Iran-linked Handala group utilized a zero-click wiper to neutralize 100,000+ medical devices globally.
What a Zero-Click Wiper Does to Clinical Fleets
A zero-click wiper does not need a user to open a file, click a link, or approve a prompt. It reaches a device through a path the device already trusts—often a management channel, a peer protocol, or a service that accepts unsolicited data—and then destroys data or firmware state so the unit cannot return to normal operation without reimaging or factory recovery. In a medical fleet, that means infusion pumps, imaging consoles, surgical systems, and bedside monitors can go dark in the same window, not because operators made a mistake, but because the attack surface was reachable without human interaction.
The Stryker-related event attributed to the Iran-linked Handala group fits that pattern at scale: a coordinated wipe aimed at more than 100,000 medical devices worldwide. Whether the payload overwrites disks, bricks boot partitions, or corrupts configuration stores, the operational result is the same. Care teams lose device availability faster than IT can triage, and hospitals must treat the outage as a clinical incident as much as a cybersecurity one.
Why Medical Device Networks Amplify Wiper Damage
Hospital and manufacturer networks still depend on long-lived embedded systems that cannot be patched on a laptop cadence. Many devices share flat VLANs with other clinical assets, accept remote service traffic, and keep credentials or certificates that outlive staff turnover. A single compromised update server, relay, or management console can become a fan-out point: one foothold, many identical endpoints.
Wipers differ from ransomware here. Ransomware often leaves a recovery path if backups and keys hold. A wiper’s goal is denial—erase, scramble, or lock firmware so the device is useless until rebuilt. For regulated medical equipment, rebuild is not a simple reinstall. Validation, calibration, and reintroduction into the care workflow take time that emergency departments and ORs may not have. That is why a global wipe campaign against a major device maker is not only a brand event; it is a simultaneous capacity shock across many sites.
Practical Hardening for Zero-Click Paths
Defenders cannot wait for a perfect vendor patch cycle. Reduce the blast radius of any unsolicited code path that can reach clinical hardware:
- Segment device fleets from general enterprise and guest networks; allow only named management hosts and protocols.
- Disable unused remote-service and discovery features; treat “convenience” ports as production attack surface.
- Require mutual authentication and signed updates for anything that can rewrite firmware or configuration.
- Monitor for mass configuration or wipe-like commands from unusual sources; rate-limit and alert on fleet-wide destructive operations.
- Keep known-good images, offline recovery media, and a documented restore runbook tested on spare units—not only on paper.
Zero-click does not mean zero-signal. Unusual peer traffic, sudden certificate or agent changes, and synchronized reboot or disk-activity spikes across a model line are early indicators that a wipe sequence may already be in motion.
What Operators Should Assume After a Fleet Wipe
After a Handala-style wipe, assume compromise of trust material, not only of patient or case data. Rotate credentials, reissue device identities, and rebuild from verified media. Isolate cleaned devices until they pass integrity checks. Coordinate with the manufacturer on which models and software generations were in scope, and treat unconfirmed “healthy” units as suspect until checked against that scope.
The broader lesson from the Stryker Global Wipe of 2026 is architectural: medical fleets need the same least-privilege and blast-radius design as critical infrastructure. Zero-click wipers succeed where many identical, long-lived devices share trusted remote control. Shrink that trust, instrument destructive actions, and practice recovery before the next wipe turns a security alert into empty beds and cancelled procedures.