Pro‑Iranian “wiper” attacks target European parliament and global med‑tech firm

Du'aine Davis

Observed in the wild

• In early March 2026, Albania’s Parliament disclosed a sophisticated cyberattack that disrupted internal email systems and allegedly exposed lawmakers’ communications, claimed by Iran‑linked group Homeland Justice. Separately, US medical technology firm Stryker suffered a global network outage after a destructive cyberattack attributed to the pro‑Iranian Handala group, impacting staff across multiple countries and halting operations.
• Both incidents are assessed as politically motivated operations linked to Iranian interests. The Albanian case involved attempted data deletion and compromise of internal systems, with claims of data theft shared on Telegram. The Stryker incident was widely described as a wiper-style attack against Microsoft Windows environments, defacing login pages and rendering endpoints unusable rather than seeking ransom.
• Affected and similar organisations are advised to monitor for destructive behaviour in Microsoft environments, including mass endpoint failures, credential misuse, and abnormal authentication activity. Strengthening Microsoft Defender for Endpoint alerts on wiper‑like behaviour, enforcing conditional access, isolating impacted devices rapidly, and maintaining tested offline backups are emphasised to limit blast radius and support recovery from non‑ransomware attacks

Iran-linked hackers claim cyberattack on Albania’s parliament email systems | The Record from Recorded Future NewsStryker Corporation Hacked – Handala Hack Team