FBI shuts down pro-Iranian hacker websites after Stryker cyberattack

The FBI has seized and taken two websites associated with the pro-Iranian hacktivist group Handala offline, which recently claimed responsibility for a disruptive cyberattack targeting U.S. medical technology company Stryker.

By Thursday, both a website used by Handala to showcase its cyber activities and another platform where the group allegedly published personal information of dozens of individuals — including those linked to Israeli military organisations and defence companies such as Elbit Systems and NSO Group — had been replaced with a notice confirming the law enforcement action.

The seizure notice did not provide a specific explanation for the takedown. However, the wording suggested that U.S. authorities believe the domains were connected to operations involving a foreign state-backed cyber group.

“Law enforcement authorities determined this domain was used to conduct, facilitate, or support malicious cyber activities on behalf of, or in coordination with, a foreign state actor,” the notice stated. “The United States Government has taken control of this domain to disrupt ongoing malicious cyber operations and prevent further exploitation.”

In response, Handala acknowledged the shutdown of its websites through posts on its official Telegram channel, describing the move as an attempt to suppress its activities.

“This act of digital aggression only serves to highlight the fear and anxiety our actions have instilled in the hearts of those who oppress and deceive,” the group said. “Although they attempt to erase the evidence and hide their crimes through censorship and intimidation, their actions only confirm the impact of our mission. The pursuit of justice cannot be stopped by taking down a website; the truth movement will persist and grow stronger.”

The group’s account on X has also reportedly been suspended.

Handala has been active since at least October 7, 2023, following attacks by Hamas, and is believed to have links to the Iranian government. The group claimed responsibility for last week’s cyberattack on Stryker, a company employing more than 56,000 people worldwide. According to the hackers, the attack was carried out in retaliation for a U.S. missile strike that reportedly hit a school in Iran, resulting in the deaths of at least 175 people, many of them children.

Stryker had previously entered into a $450 million agreement to provide medical equipment to the U.S. Department of Defence.

Reports indicate that Handala gained access to an internal administrative account within Stryker, allowing extensive control over the company’s Windows network. The attackers are believed to have taken control of Stryker’s Microsoft Intune system, a platform used to manage company laptops and mobile devices remotely, including the capability to erase data.

Using this access, the hackers allegedly wiped data from a large number of devices belonging to both the company and its employees.

As of Tuesday, Stryker stated that it is still restoring its systems following the breach.

Nariman Gharib, a U.K.-based Iranian activist and independent cyber-espionage researcher, said the takedown of the group’s websites represents a significant disruption to its operations.

“Their organisational and management structure is currently disrupted, and at any moment, members of this group may be targeted by missile strikes, just like other cyber forces of the regime,” Gharib said.

However, he also cautioned that such actions may not completely halt the group’s activities.

“But this does not mean that their activities may stop — no. This group may publish future leaks through media close to the IRGC,” he added, referring to Iran’s military organisation.