stryker

Executive Summary

The Stryker threat actor represents a significant Iranian cyber capability, likely state-sponsored. Known for sophisticated attacks including wiper malware incidents targeting US corporate infrastructure, they demonstrate advanced operational capabilities. Their use of legitimate MDM tools for destructive purposes underscores their ability to adapt and escalate operations.

Goals & Targeting

Stryker targets sectors like government and corporate infrastructure, likely aiming to achieve strategic disruption or damage. Their focus on high-value Western targets aligns with broader geopolitical objectives, possibly for influence or economic gain.

Stryker is part of Iran's complex cyber ecosystem, combining state-directed APT groups with contractors and hacktivists. The March 11, 2026 attack marked a notable shift by employing destructive wiper malware without traditional malware, targeting US corporate infrastructure via MDM abuse. This indicates high sophistication and willingness to disrupt Western entities, suggesting nation-state involvement.

Key Capabilities

• Destructive wiper malware
• Abuse of legitimate MDM infrastructure
• High-sophistication attacks suggesting nation-state sponsorship

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Stryker's campaign against the US highlights strategic targeting of critical infrastructure. Their use of novel attack vectors and rapid operational tempo suggests alignment with state-sponsored objectives.

IOC Patterns

• Abnormal MDM infrastructure activity
• unauthorized access attempts via legitimate IT tools
• Signs of internal communications disruption

Recommended Actions

• Monitor MDM systems for suspicious activities
• Enhance third-party vendor security practices
• Implement network segmentation to mitigate spread

Suggested Tags