Stryker Cyberattack Targets Endpoint Management Systems, Exposing Identity Risks in Intune

Medical technology firm Stryker suffered a cyberattack reported to be linked to Iranian threat actors. The incident disrupted its Microsoft environment and affected manufacturing operations, underscoring how attackers increasingly target endpoint management systems like Microsoft Intune to gain wide operational control. According to CISA, the attack used misuse of legitimate administrative access. Once administrative credentials were compromised, the attacker could issue legitimate commands through the management plane—so systems like Intune executed changes at scale. The core risk is that centralized control planes concentrate power, making identity the primary battleground. CISA urged organizations to harden endpoint management systems by enforcing least privilege with role-based access control (RBAC). It also recommended phishing-resistant multi-factor authentication (MFA), conditional access policies, and multi-admin approval for sensitive actions to reduce the blast radius of any single compromised account. The guidance emphasizes credential hygiene (e.g., removing shared/default credentials, secure password handling) and reducing standing privileges via just-in-time access. A Zero Trust approach is framed as essential to contain threats, continuously verify identity, and limit lateral movement. The article adds that additional safeguards should be placed around high-impact actions (such as device wipes and large-scale configuration changes), using policy-driven approvals and integrity controls so a single identity cannot trigger widespread disruption.