This article presents a five-step playbook for CISOs to stop Iranian wiper campaigns by emphasizing containment, identity-aware controls, and automated isolation. Using the Iran-linked Handala attack on Stryker as an example, it argues that preventing lateral movement and restricting privileged access is more effective than relying solely on perimeter defenses. #Handala #Stryker
Keypoints
- Destructive Iranian campaigns often start with stolen credentials and hands-on activity inside networks.
- Attackers leverage legitimate administrative tools (RDP, PowerShell, WMI, SMB, SSH) to move laterally without triggering malware alerts.
- Identity-aware access controls, MFA for administrative services, and default-deny policies for admin ports reduce attack pathways.
- Monitoring east-west traffic and detecting tunneling tools like NetBird uncovers covert access paths and abnormal connectivity.
- Automated isolation, immediate restriction of admin access, and rapid ring-fencing limit blast radius during wiper incidents.