A 5-step guide to prevent Iranian wiper attacks from spreading.

International tensions are increasingly seen in the cyber world. For CISOs, this means preparing for attacks motivated by disruption, not profit.

State-sponsored or politically motivated groups are using damaging malware to disable organizations and vital infrastructure. Unlike ransomware attackers seeking payment, these groups aim for operational breakdown.

Iranian wiper attacks serve as a prime example of this trend.

These attacks are designed to destroy systems, halt operations, and trigger widespread real-world impact. They often target organizations in crucial supply chains, healthcare, or national infrastructure.

For security leaders, the focus is shifting from simply preventing intrusions to ensuring survival after a breach occurs.

Recent events underscore the potential of these attacks. In March 2026, the Iranian-linked Handala group targeted Stryker, a major medical technology manufacturer for hospitals globally.

Reports indicate the attackers wiped tens of thousands of devices across Stryker’s network, disrupting operations in 79 countries and affecting thousands of employees through slowed manufacturing, processing, and logistics.

Events like these illustrate a growing trend: cybersecurity incidents are becoming more interconnected with geopolitical struggles.

However, despite the headlines, destructive cyber attacks tend to follow predictable patterns. By understanding these patterns, defenders can minimize damage even after a successful breach.

Research on the Handala / Void Manticore group shows that many Iranian attacks depend on manual steps rather than overly sophisticated malware.

Attackers typically:

• Start by gaining access with stolen VPN credentials
• Engage in hands-on activity within the system
• Move across the system using admin tools
• Increase their access privileges
• Apply multiple wiping techniques at once

Operators often use tools already on the system, like:

• RDP
• PowerShell remoting
• WMI
• SMB
• SSH

Because these are ordinary admin tools, attackers can easily move through networks without triggering regular virus detection.

Researchers have also noted operators creating hidden access using tools like NetBird, which lets them maintain persistent access to the attacked systems.

In other words, destructive attacks usually work because attackers can move freely after the initial breach, not because their malware is advanced.

Preventing these attacks requires focusing on containing and controlling internal access, not just defending the perimeter.

Based on current attack methods, CISOs can greatly lessen the impact of destructive attacks with key controls.

Most destructive attacks start with stolen credentials from phishing, reusing passwords, or access brokers.

In many systems, VPN access allows widespread network access. This is what attackers rely on.

Organizations should instead use:

• Access controls based on identity instead of simple network access
• Multi-factor authentication (MFA) enforced for admin services, not just VPN login
• Constant monitoring of which accounts access which systems

Even with valid credentials, attackers should not immediately access sensitive services.

Iranian operators often spread through systems using standard admin tools.

These tools are often left open for ease of use, allowing attackers to move fast between systems.

A stronger system includes:

• Denying access to admin ports by default
• Granting access only after verifying authentication
• Monitoring system connectivity in real time

This greatly reduces the ways attackers can move.

Many systems still give administrators broad access network-wide.

This convenience is a risk.

If attackers compromise an admin account, they can reach almost any system.

Organizations should:

• Divide admin access by roles and environments
• Restrict administrators to only the systems they manage
• Continuously monitor admin activity

Limiting the scope of admin access significantly lessens the impact of a breach.

Recent reports show Iranian operators using tunneling tools to maintain hidden system access.

These tunnels can avoid perimeter monitoring.

Defenders need to monitor activity inside the network, and should include:

• Monitoring internal traffic
• Establishing normal communication patterns
• Detecting suspicious routes or tunneling

By detecting unusual patterns, defenders can act before damage occurs.

When wiper malware starts, attackers often use several methods simultaneously to cause maximum damage.

Speed is essential at this point.

Organizations that overcome destructive incidents focus on containment.

Key steps include:

• Automatically isolating affected systems
• Immediately limiting admin access
• Quickly securing affected parts of the network

If done quickly, the attack may only impact a few systems rather than the entire system.

Iranian attacks show that attackers do not need complex malware when networks allow unrestricted internal access.

The best defense is not improved virus detection.

It is removing the attacker’s ability to move.

Organizations that limit the effect of destructive attacks share these abilities:

• Monitoring who accesses what
• Controlling admin services and privileged access
• Automated containment to limit the impact

Attackers might still get inside.

But without movement, they cannot cause destruction.

In an era of geopolitical cyber conflict, this ability may determine if an organization survives or collapses.

Sponsored and written by Zero Networks.