John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
March 11, 2026. Three attacks. Three countries. Three different methods. Same Iranian-linked actors. Same 24-hour window.
This isn’t three stories. It’s one.
Handala, an Iran-linked hacktivist group, deployed wiper malware against Stryker Corporation. Not ransomware. Not data theft. A wiper. Software built to destroy. Stryker makes surgical robots, orthopedic implants, hospital beds. They do $22 billion a year. When their systems go down, hospitals feel it.
BleepingComputer confirmed employees reported wiped devices. Handala took credit publicly, framing it as retaliation for US and Israeli policy. The choice to deploy destructive malware against a company whose products are literally inside patients’ bodies is a calculated escalation. That’s not a hacktivist stunt. That’s a message.
Same day, a few thousand miles east, Iran-linked hackers compromised Albania’s parliamentary email systems. Albania’s been a repeat target since 2022 because they host the MEK, an Iranian opposition group Tehran wants gone. But hitting a NATO member’s parliament isn’t just harassment. It’s intelligence collection against a democratic institution in a Western alliance.
And while all that was happening, Meta was pulling down an Iranian influence operation running fake American personas on Instagram, pushing narratives at US audiences.
Destructive. Espionage. Influence. Three domains. One campaign. One day.
Palo Alto’s Unit 42 published a threat brief nine days earlier flagging exactly this kind of multi-vector escalation from Iranian groups. March 11 was the proof of concept.
If you’re in healthcare, government, or critical infrastructure, that Unit 42 brief is worth reading in full. And if your incident response plans are built around ransomware, you need a wiper playbook too. Ransomware actors want your money. Wipers just want your systems dead. Backup integrity and offline recovery capability hit different when the goal is destruction, not extortion.
Iran isn’t running isolated ops anymore. They’re running a coordinated campaign with tempo. Plan accordingly.